CVE-2018-0167highunder attackCWE-119

CVE-2018-0167: high-severity vulnerability in Cisco IOS, IOS XE, and IOS XR

Published · Updated

Follow this CVE+ Monitor Cisco IOS XE+ Monitor IOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 3.4%
from disclosure to weapon
Published on NVDMar 28
CISA KEV+1436d
Action required by CISAfederal deadline: 2022-03-17

Apply updates per vendor instructions.

In short

A flaw in Cisco's network discovery system allows attackers on the same network to crash devices or take control of them without needing a password. The problem is caused by improper handling of data that exceeds expected limits.

Technical detail

Multiple buffer overflow vulnerabilities in the LLDP subsystem allow an unauthenticated, adjacent network attacker to trigger denial of service or arbitrary code execution with elevated privileges. The vulnerability requires network proximity but no authentication, exploiting improper input validation in protocol message handling.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Cisco IOS, IOS XE, and IOS XR