VULNERABILITY INTELLIGENCE

CVE-2015-0733

CVSS score4.3 MEDIUM

EPSS probability1.54%

CISA KEVNot currently listed

Published2015-05-30

Last modified2026-06-17

CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N

Description

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID CSCur25580.

Weakness classification

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Primary references

psirt@cisco.com — Vendor Advisory
psirt@cisco.com — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry