CVE-2018-0151
published 2018-03-28CVE-2018-0151: A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to…
PriorityP189critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-03-17
Exploited in the wild
EPSS
14.47%
96.2th percentile
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 18999 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code on the affected device with elevated privileges. The attacker could also leverage this vulnerability to cause the device to reload, causing a temporary DoS condition while the device is reloading. The malicious packets must be destined to and processed by an affected device. Traffic transiting a device will not trigger the vulnerability. Cisco Bug IDs: CSCvf73881.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ios_and_ios_xe | — | — |
| cisco | ios_xe | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
Snort Rules 46110 and 46111
- →Monitor and alert on inbound packets destined for UDP port 18999 on Cisco IOS/IOS XE devices; only packets destined to and processed by the device (not transit traffic) trigger the vulnerability. ↗
- →Apply a Control Plane Policing (CoPP) policy to deny all traffic destined to UDP port 18999 as a detection/blocking measure for devices not using Adaptive QoS for DMVPN. ↗
- ·The vulnerability is only exploitable when the Adaptive QoS for DMVPN feature is in use; devices not using this feature can mitigate via CoPP, but must remove the CoPP policy if the feature is later configured (requiring a full upgrade first). ↗
- ·Affected Rockwell Automation Allen-Bradley Stratix 5900 Services Router versions 15.6.3M1 and earlier are vulnerable due to use of a vulnerable version of Cisco IOS or IOS XE. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_cisco9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mpwr-vh8m-qpfg: A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attac
ghsa_unreviewed·2022-05-13
CVE-2018-0151 [CRITICAL] CWE-119 GHSA-mpwr-vh8m-qpfg: A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attac
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 18999 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code on the affected device with elevated privileges. The attacker could also leverage this vulnerability to cause the device to reload, causing a temporary D
VulnCheck
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
vulncheck·2018·CVSS 9.8
CVE-2018-0151 [CRITICAL] CWE-119 Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.
Affected: Cisco IOS and IOS XE Software
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-03-17
CISA
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
cisa·2022-03-03·CVSS 9.8
CVE-2018-0151 [CRITICAL] CWE-119 Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
Vulnerability: Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
Affected: Cisco IOS and IOS XE Software
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-0151
Remediation Due Date: 2022-03-17
CISA ICS
Rockwell Automation Stratix Services Router
cisa_ics·2018-04-25·CVSS 8.6
[HIGH] Rockwell Automation Stratix Services Router
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Rockwell Automation Stratix Services Router
Last RevisedApril 25, 2018
Alert CodeICSA-18-107-03
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit.
- Vendor: Rockwell Automation
- Equipment: Allen-Bradley Stratix 5900 Services Router
- Vulnerabilities: Improper Input Validation, Improper Restriction of Operations within the Bounds of a Memory Buffer, Use of Externally-Controlled Format String.
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in loss of availability, confidentiality, and/or i
Cisco
Cisco IOS and IOS XE Software Quality of Service Remote Code Execution Vulnerability
vendor_cisco·2018-03-28·CVSS 9.8
CVE-2018-0151 [CRITICAL] CWE-119 Cisco IOS and IOS XE Software Quality of Service Remote Code Execution Vulnerability
Cisco IOS and IOS XE Software Quality of Service Remote Code Execution Vulnerability
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.
The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 18999 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code on the affected device with elevated privileges. The attacker coul
Cisco
Cisco IOS and IOS XE Software Quality of Service Remote Code Execution Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0151 Cisco IOS and IOS XE Software Quality of Service Remote Code Execution Vulnerability
CVE-2018-0151: Cisco IOS and IOS XE Software Quality of Service Remote Code Execution Vulnerability
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 18999 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code on the affected device with elevated privileges. The
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/103540http://www.securitytracker.com/id/1040582https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-qoshttp://www.securityfocus.com/bid/103540http://www.securitytracker.com/id/1040582https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-qoshttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0151
2018-03-28
Published
2022-03-03
Added to CISA KEV
Exploited in the wild