⚠ Actively exploited

Added to CISA KEV on 2022-03-03. Federal agencies required to patch by 2022-03-17. Required action: Apply updates per vendor instructions..

CVE-2018-0173 — Improper Input Validation in Cisco IOS

CWE-20 — Improper Input Validation6 documents6 sources

Severity

8.6HIGHNVD

EPSS

5.4%

top 9.82%

CISA KEV

KEV

Added 2022-03-03

Due 2022-03-17

Exploit

Exploited in wild

Active exploitation observed

Affected products

Cisco IOS Cisco IOS XE

Timeline

PublishedMar 28

KEV addedMar 3

KEV dueMar 17

Latest updateMay 13

CISA Required Action: Apply updates per vendor instructions.

Description

A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages2 packages

▶NVDcisco/ios15.2\(6\)e0a+2

▶NVDcisco/ios_xe15.2\(6\)e0a+2

🔴Vulnerability Details

GHSA

GHSA-pp38-rv9h-g7rc: A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv↗2022-05-13

▶

CVEList

CVE-2018-0173: A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv↗2018-03-28

▶

VulnCheck

Cisco IOS and IOS XE Software Improper Input Validation Vulnerability↗2018

▶

📋Vendor Advisories

CISA

Cisco IOS and IOS XE Software Improper Input Validation Vulnerability↗2022-03-03

▶

Cisco

Cisco IOS and IOS XE Software DHCP Version 4 Relay Reply Denial of Service Vulnerability↗2018-03-28

▶