⚠ Actively exploited
Added to CISA KEV on 2022-03-03. Federal agencies required to patch by 2022-03-17. Required action: Apply updates per vendor instructions..

CVE-2018-0158 — Improper Input Validation in Cisco IOS

CWE-20 — Improper Input ValidationCWE-401 — Missing Release of Memory after Effective LifetimeCWE-772 — Missing Release of Resource after Effective Lifetime9 documents9 sources
Severity
8.6HIGHNVD
EPSS
14.6%
top 5.52%
CISA KEV
KEV
Added 2022-03-03
Due 2022-03-17
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Cisco IOSCisco IOS XE
Timeline
PublishedMar 28
KEV addedMar 3
KEV dueMar 17
Latest updateMay 13
CISA Required Action: Apply updates per vendor instructions.

Description

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause a…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages2 packages

▶NVDcisco/ios10 versions+9
▶NVDcisco/ios_xe10 versions+9

🔴Vulnerability Details

3
GHSA
GHSA-fm8f-3j2c-52xr: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated,↗2022-05-13
▶
CVEList
CVE-2018-0158: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated,↗2018-03-28
▶
VulnCheck
Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability↗2018
▶

📋Vendor Advisories

2
CISA
Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability↗2022-03-03
▶
Cisco
Cisco IOS and IOS XE Software Internet Key Exchange Memory Leak Vulnerability↗2018-03-28
▶

💬Community

1
Bugzilla
CVE-2017-3144 dhcp: omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service↗2017-12-06
▶
CVE-2018-0158 — Improper Input Validation in Cisco IOS | cvebase