CVE-2018-0175
- EPSS 1.91%
- Published 28.03.2018 22:29:01
- Last modified 27.01.2025 20:08:39
- Source psirt@cisco.com
- Teams watchlist Login
- Open Login
Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.
Rockwellautomation ≫ Allen-bradley Stratix 5400 Version-
Rockwellautomation ≫ Allen-bradley Stratix 5410 Version-
Rockwellautomation ≫ Allen-bradley Stratix 5700 Version-
Rockwellautomation ≫ Allen-bradley Stratix 8000 Version-
Rockwellautomation ≫ Allen-bradley Stratix 5400 Version-
Rockwellautomation ≫ Allen-bradley Stratix 5410 Version-
Rockwellautomation ≫ Allen-bradley Stratix 5700 Version-
Rockwellautomation ≫ Allen-bradley Stratix 8000 Version-
03.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
VulnerabilityFormat string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.
DescriptionApply updates per vendor instructions.
Required actions| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.91% | 0.826 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8 | 2.1 | 5.9 |
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.9 | 5.5 | 10 |
AV:A/AC:M/Au:N/C:C/I:C/A:C
|
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.