CVE-2018-0159

Warning

EPSS 6.18%
Published 28.03.2018 22:29:00
Last modified 27.01.2025 20:17:00
Source psirt@cisco.com
Teams watchlist Login
Open Login

A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.

Affected products Warnungen 1 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Ios Version15.3(3)s

   Cisco ≫ Asr 901-12c-f-d Version-
   Cisco ≫ Asr 901-12c-ft-d Version-
   Cisco ≫ Asr 901-4c-f-d Version-
   Cisco ≫ Asr 901-4c-ft-d Version-
   Cisco ≫ Asr 901-6cz-f-a Version-
   Cisco ≫ Asr 901-6cz-f-d Version-
   Cisco ≫ Asr 901-6cz-ft-a Version-
   Cisco ≫ Asr 901-6cz-ft-d Version-
   Cisco ≫ Me 3600x-24cx-m Version-
   Cisco ≫ Me 3600x-24fs-m Version-
   Cisco ≫ Me 3600x-24ts-m Version-
   Cisco ≫ Me 3800x-24fs-m Version-

Cisco ≫ Ios Xe Version15.3(3)s

03.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability

Vulnerability

A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.

Description

Apply updates per vendor instructions.

Required actions

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	6.18%	0.899

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	7.8	10	6.9	AV:N/AC:L/Au:N/C:N/I:N/A:C

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securitytracker.com/id/1040595

Third Party Advisory

Broken Link

VDB Entry

http://www.securityfocus.com/bid/103562

Third Party Advisory

Broken Link

VDB Entry

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike-dos

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-0159

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-0159

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-0159

EUVD