CVE-2018-0173
published 2018-03-28CVE-2018-0173: A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4)…
PriorityP180high8.6CVSS 3.1
AVNACLPRNUINSCCNINAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-03-17
Exploited in the wild
EPSS
7.76%
94.0th percentile
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ios | <= 15.2\(6\)e0a | — |
| cisco | ios | <= 15.2\(4a\)ea5 | — |
| cisco | ios | — | — |
| cisco | ios_and_ios_xe | — | — |
| cisco | ios_xe | <= 15.2\(6\)e0a | — |
| cisco | ios_xe | <= 15.2\(4a\)ea5 | — |
| cisco | ios_xe | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: crafted DHCPv4 packet with option 82 carrying an invalid (too long) length field, sent to a device acting as a DHCP relay agent, causing a bad memset size calculation and access violation on receipt of the DHCPOFFER response ↗
- →Attack vector: the malicious packet must be a DHCPv4 packet forwarded by the relay agent to a DHCPv4 server; the vulnerability is triggered when the relay agent processes the encapsulated option 82 in the DHCPOFFER response from the server ↗
- →Cisco Bug ID CSCvg62754 can be used to track vendor patches and correlate device logs or crash reports to this specific vulnerability ↗
- ·Vulnerability only affects devices with the DHCP relay agent configured (ip helper-address); devices not acting as a DHCPv4 relay agent are not affected ↗
- ·The vulnerability is triggered specifically during processing of DHCPOFFER messages (relay reply path), not during the initial client request forwarding path ↗
- ·No workarounds are available; only vendor software updates address this vulnerability ↗
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
vulncheck8.6HIGH
cisa8.6HIGH
vendor_cisco8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
cisa·2022-03-03·CVSS 8.6
CVE-2018-0173 [HIGH] CWE-20 Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Vulnerability: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Affected: Cisco IOS and IOS XE Software
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-0173
Remediation Due Date: 2022-03-17
CISA ICS
Rockwell Automation Stratix Industrial Managed Ethernet Switch
cisa_ics·2018-04-25·CVSS 9.8
[CRITICAL] Rockwell Automation Stratix Industrial Managed Ethernet Switch
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Rockwell Automation Stratix Industrial Managed Ethernet Switch
Last RevisedApril 25, 2018
Alert CodeICSA-18-107-05
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit.
- Vendor: Rockwell Automation
- Equipment: Allen-Bradley Stratix Industrial Managed Ethernet Switch
- Vulnerabilities: Improper Input Validation, Resource Management Errors, 7PK – Errors, Improper Restriction of Operations within the Bounds of a Memory Buffer, Use of Externally-Controlled Format String.
## 2. RISK EVALUATION
Successful exploitation of these vuln
CISA ICS
Rockwell Automation Stratix and ArmorStratix Switches
cisa_ics·2018-04-25
Rockwell Automation Stratix and ArmorStratix Switches
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Rockwell Automation Stratix and ArmorStratix Switches
Last RevisedApril 25, 2018
Alert CodeICSA-18-107-04
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit.
- Vendor: Rockwell Automation
- Equipment: Allen-Bradley Stratix and ArmorStratix Switches
- Vulnerabilities: Improper Input Validation, Resource Management Errors, Improper Restriction of Operations within the Bounds of a Memory Buffer, Use of Externally-Controlled Format String.
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in loss
Cisco
Cisco IOS and IOS XE Software DHCP Version 4 Relay Reply Denial of Service Vulnerability
vendor_cisco·2018-03-28·CVSS 8.6
CVE-2018-0173 [HIGH] CWE-20 Cisco IOS and IOS XE Software DHCP Version 4 Relay Reply Denial of Service Vulnerability
Cisco IOS and IOS XE Software DHCP Version 4 Relay Reply Denial of Service Vulnerability
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.
The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 informatio
Cisco
Cisco IOS and IOS XE Software DHCP Version 4 Relay Reply Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0173 Cisco IOS and IOS XE Software DHCP Version 4 Relay Reply Denial of Service Vulnerability
CVE-2018-0173: Cisco IOS and IOS XE Software DHCP Version 4 Relay Reply Denial of Service Vulnerability
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 8
GHSA
GHSA-pp38-rv9h-g7rc: A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv
ghsa_unreviewed·2022-05-13
CVE-2018-0173 [HIGH] CWE-20 GHSA-pp38-rv9h-g7rc: A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A
VulnCheck
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
vulncheck·2018·CVSS 8.6
CVE-2018-0173 [HIGH] CWE-20 Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
Affected: Cisco IOS and IOS XE Software
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180328-dhcpr2.html
Remediation Due: 2022-03-17
No detection rules found.
No public exploits indexed.
Tenable
Tenable Research: February and March Vulnerability Disclosure Roundup
blogs_tenable·2018-04-13·CVSS 8.8
[HIGH] Tenable Research: February and March Vulnerability Disclosure Roundup
Blog / Research
Subscribe
# Tenable Research: February and March Vulnerability Disclosure Roundup
Tenable Research
April 13, 2018
4 Min Read
Tenable Research has a dedicated team that performs vulnerability research on software and hardware from third-party vendors. The goal is to discover zero-day vulnerabilities and work with vendors to get them addressed before hackers discover and exploit them.
This post provides an overview of all the vulnerabilities discovered by Tenable Research in February and March.
You can access all Tenable Research advisories here.
EMC VASA Virtual Appliance Default Credentials and Arbitrary File Upload
CVE ID: CVE-2018-1216, CVE-2018-1215
Nessus Plugin ID: 106849
Tenable Research Advisory: TRA-2018-03
Risk Factor: Critical
What do you need to know
Tenable
Tenable Research: February and March Vulnerability Disclosure Roundup
blogs_tenable·2018-04-13
Tenable Research: February and March Vulnerability Disclosure Roundup
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
[R1] Cisco IOS and IOS XE Multiple Memory Corruption Vulnerabilities
blogs_tenable·2018-03-28
[R1] Cisco IOS and IOS XE Multiple Memory Corruption Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://www.securityfocus.com/bid/103545http://www.securitytracker.com/id/1040591https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2https://www.tenable.com/security/research/tra-2018-06http://www.securityfocus.com/bid/103545http://www.securitytracker.com/id/1040591https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2https://www.tenable.com/security/research/tra-2018-06https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0173
2018-03-28
Published
2022-03-03
Added to CISA KEV
Exploited in the wild