CVE-2014-2201
CVE-2014-2201 is a high-severity vulnerability in Cisco Nx-os with a CVSS 2.0 base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 2.0 base score 7.8)
- EPSS exploit prediction: 2% (77th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Cisco Nx-os
- Published:
- Last modified:
Description
The Message Transfer Service (MTS) in Cisco NX-OS before 6.2(7) on MDS 9000 devices and 6.0 before 6.0(2) on Nexus 7000 devices allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a large volume of crafted traffic, aka Bug ID CSCtw98915.
Frequently asked questions
- What is CVE-2014-2201?
- The Message Transfer Service (MTS) in Cisco NX-OS before 6.2(7) on MDS 9000 devices and 6.0 before 6.0(2) on Nexus 7000 devices allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a large volume of crafted traffic, aka Bug ID CSCtw98915.
- How severe is CVE-2014-2201?
- CVE-2014-2201 has a CVSS 2.0 base score of 7.8, rated high severity.
- Is CVE-2014-2201 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-2201?
- CVE-2014-2201 primarily affects Cisco Nx-os. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2014-2201?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2014-2201 published?
- CVE-2014-2201 was published on 2014-05-26 and last updated on 2026-06-17.
References
Affected products (13)
- cpe:2.3:o:cisco:nx-os:6.0\(1\):*:*:*:*:*:*:*
- cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:nexus_7000_10-slot:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:nexus_7000_18-slot:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:nexus_7000_9-slot:-:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:6.2\(1\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:6.2\(1n\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:6.2\(3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:6.2\(3n\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:nx-os:6.2\(5\):*:*:*:*:*:*:*
- cpe:2.3:h:cisco:mds_9000:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:mds_9100:-:*:*:*:*:*:*:*
More vulnerabilities in Cisco Nx-os
- CVE-2021-1361 — Critical (CVSS 9.8): A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and…
- CVE-2018-0310 — Critical (CVSS 9.8): A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an…
- CVE-2018-0301 — Critical (CVSS 9.8): A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft…
- CVE-2016-1453 — Critical (CVSS 9.8): Buffer overflow in the Overlay Transport Virtualization (OTV) GRE feature in Cisco NX-OS 5.0 through 7.3 on Nexus 7000…
- CVE-2016-1341 — Critical (CVSS 9.8): Cisco NX-OS 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1) on Nexus 2000 Fabric Extender devices has a blank root password,…
- CVE-2015-4235 — Critical (CVSS 9.0): Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j)…