Junglewise Threat Intelligence

CVE-2018-0173: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

CVE-2018-0173 · Severity: critical · CVSS 8.6 · Exploited in the wild · Published 2022-03-03

Technologies: Cisco IOS, Cisco IOS XE Software, Cisco IOS XE, Cisco IOS XR. Vendors: Rockwell Automation, Cisco.

Executive brief

A vulnerability in Cisco IOS and IOS XE Software's DHCPv4 relay function allows an unauthenticated remote attacker to cause a denial-of-service (DoS) via a device reload. The issue stems from improper input validation of encapsulated DHCP Option 82 information in DHCPOFFER messages.

Affected products

  • Cisco IOS Up to 15.2(6)e0a
  • Cisco IOS XE Up to 15.2(6)e0a
  • Cisco IOS Denali 16.3.4
  • Rockwell Automation Stratix 5400/5410/5700/8000/8300

Timeline

  • 2018-03-28: disclosed: Initial Cisco advisory publication
  • 2022-03-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

Related threats