Is CVE-2018-0125 exploited in the wild?

Yes. CVE-2018-0125 is known to be exploited in the wild, first recorded on 25 March 2022. Treat it as urgent.

How severe is CVE-2018-0125?

Critical severity, with a CVSS score of 9.8, published 25 March 2022.

Which products and versions are affected?

Cisco RV132W ADSL2+ Wireless-N VPN Router Firmware versions prior to 1.0.1.11; Cisco RV134W VDSL2 Wireless-AC VPN Router Firmware versions prior to 1.0.1.11.

Is there a fix for CVE-2018-0125?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2018-0125 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2018-0125?

Check whether you run Cisco VPN Routers. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-0125: Cisco VPN Routers Remote Code Execution Vulnerability

CVE-2018-0125 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-03-25

A vulnerability in the web interface of Cisco RV132W and RV134W VPN routers allows an unauthenticated, remote attacker to execute arbitrary code with root privileges. The issue stems from incomplete input validation of HTTP requests, which can also be exploited to cause a denial of service condition via system reload.

Vendors: Cisco.

Quick answers

Is CVE-2018-0125 exploited in the wild?: Yes. CVE-2018-0125 is known to be exploited in the wild, first recorded on 25 March 2022. Treat it as urgent.
How severe is CVE-2018-0125?: Critical severity, with a CVSS score of 9.8, published 25 March 2022.
Which products and versions are affected?: Cisco RV132W ADSL2+ Wireless-N VPN Router Firmware versions prior to 1.0.1.11; Cisco RV134W VDSL2 Wireless-AC VPN Router Firmware versions prior to 1.0.1.11.
Is there a fix for CVE-2018-0125?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2018-0125 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2018-0125?: Check whether you run Cisco VPN Routers. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

Cisco RV132W ADSL2+ Wireless-N VPN Router Firmware versions prior to 1.0.1.11
Cisco RV134W VDSL2 Wireless-AC VPN Router Firmware versions prior to 1.0.1.11

Timeline

2018-02-07: disclosed: Initial Cisco security advisory published
2022-03-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2022-03-25: exploited: Reported as exploited in the wild per CISA KEV entry

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.