Cisco IOS Telnet and Reverse Telnet Denial of Service Vulnerability via Crafted TCP Connections (CVE-2004-1464)
Executive & SecOps Summary
SECOPS ASSESSMENTCisco IOS 12.2(15) and earlier versions
Remote attackers can cause a denial of service (refused VTY connections) by exhausting virtual terminal resources using crafted TCP connection requests
Upgrade to a patched Cisco IOS release, disable Telnet in favor of SSH, and restrict VTY access using Access Control Lists (ACLs)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Cisco recommends upgrading to a non-vulnerable release of Cisco IOS. Verify your current version and perform an upgrade via TFTP/FTP as shown below.
# Verify current IOS version and boot image
show version
# Download and flash the patched IOS image from a secure TFTP server
copy tftp: flash:
# Address or name of remote host? 192.168.1.100
# Source filename? c2600-adventerprisek9-mz.122-28.bin
# Destination filename [c2600-adventerprisek9-mz.122-28.bin]?
# Configure the system to boot from the new image
configure terminal
no boot system
boot system flash c2600-adventerprisek9-mz.122-28.bin
end
write memory
reload2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, disable Telnet, enforce SSH, and restrict VTY access to trusted administrative subnets using an Access Control List (ACL).
configure terminal
# 1. Define an ACL allowing only trusted management IPs (e.g., 10.1.1.0/24)
access-list 10 permit 10.1.1.0 0.0.0.255
access-list 10 deny any log
# 2. Apply the ACL to VTY lines and restrict transport input to SSH only
line vty 0 4
access-class 10 in
transport input ssh
exec-timeout 5 0
end
write memory3. Log Audit & IoC Verification Commands
Use the following diagnostic commands to inspect active VTY sessions and identify potential connection exhaustion attempts.
# Display currently active user sessions and source IPs
show users
# Check active TCP connections and pending states
show tcp brief
# Verify VTY line configuration and timeout settings
show running-config | section line vtyStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2004-1464) is a resource exhaustion issue (CWE-400) within the Virtual Terminal (VTY) management component of Cisco IOS. In Cisco IOS 12.2(15) and prior, the operating system fails to properly release allocated VTY resources when handling incomplete or anomalous TCP connection attempts directed at the Telnet (TCP port 23) or reverse Telnet ports. This flaw allows unauthenticated remote attackers to block legitimate administrative access.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates multiple crafted TCP connection requests to the target device's Telnet or reverse Telnet ports. By deliberately leaving these TCP handshakes incomplete or maintaining idle, non-responsive connections, the attacker forces the IOS device to keep VTY lines allocated. Because Cisco IOS limits the number of concurrent VTY lines (typically configured via 'line vty 0 4'), exhausting these slots prevents legitimate administrators from establishing remote management sessions.
3. Infrastructure & Business Impact
As a vulnerability listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, this flaw has been actively exploited in the wild. Successful exploitation results in a complete denial of service (DoS) for remote management. Network administrators lose the ability to remotely configure or troubleshoot critical routing and switching infrastructure, potentially leading to prolonged network outages and severe operational disruption.
Official Vendor Advisories & References
Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.
Frequently Asked SecOps Questions (CVE-2004-1464)
FAQQ1. How critical is CVE-2004-1464 and is it actively exploited in the wild?
CVE-2004-1464 is rated CVSS 5.9 (MEDIUM) with a 30-day EPSS exploitation probability of 4.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2004-1464?
Primary impacted vendors include cisco across ios. Scope summary: Cisco IOS 12.2(15) and earlier with Telnet or reverse Telnet services enabled
Q3. What temporary mitigations or workarounds exist for CVE-2004-1464 before patching?
[Mitigation] Upgrade to a patched Cisco IOS release, disable Telnet in favor of SSH, and restrict VTY access using Access Control Lists (ACLs) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2004-1464
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cisco)
View Category →Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Cisco Secure Firewall Management Center (FMC) Insecure Deserialization Vulnerability (CVE-2026-20131, CVSS 10.0) - Remote Code Execution and Root Privilege Escalation
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.