CVE-2018-0174
published 2018-03-28CVE-2018-0174: A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote…
PriorityP279high8.6CVSS 3.1
AVNACLPRNUINSCCNINAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-03-17
Exploited in the wild
EPSS
7.76%
94.0th percentile
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuh91645.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ios | <= 15.2\(4a\)ea5 | — |
| cisco | ios | <= 15.2\(6\)e0a | — |
| cisco | ios | — | — |
| cisco | ios_and_ios_xe | — | — |
| cisco | ios_xe | <= 15.2\(4a\)ea5 | — |
| cisco | ios_xe | <= 15.2\(6\)e0a | — |
| cisco | ios_xe | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: attacker sends a crafted DHCPv4 packet where the client-provided option 82 causes pEndOfEncapsulatedOpt82 to exceed pEndOfMsg, resulting in a very large memmove and access violation (device reload/DoS) ↗
- →Target protocol/feature: DHCP option 82 encapsulation in DHCPv4 relay agent on Cisco IOS and IOS XE; monitor for crafted DHCPv4 packets containing malformed option 82 data sent to devices acting as DHCP relay agents ↗
- →Cisco Bug ID CSCuh91645 can be used to cross-reference affected software versions and patch status in Cisco's security tooling ↗
- ·Vulnerability is only exploitable on devices with DHCP relay agent functionality enabled and configured to process option 82 encapsulation; devices not acting as DHCP relay agents are not affected ↗
- ·No workarounds are available; only vendor software updates address this vulnerability ↗
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
vulncheck8.6HIGH
cisa8.6HIGH
vendor_cisco8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
cisa·2022-03-03·CVSS 8.6
CVE-2018-0174 [HIGH] CWE-20 Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
Vulnerability: Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
Affected: Cisco IOS XE Software
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-0174
Remediation Due Date: 2022-03-17
CISA ICS
Rockwell Automation Stratix Industrial Managed Ethernet Switch
cisa_ics·2018-04-25·CVSS 9.8
[CRITICAL] Rockwell Automation Stratix Industrial Managed Ethernet Switch
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Rockwell Automation Stratix Industrial Managed Ethernet Switch
Last RevisedApril 25, 2018
Alert CodeICSA-18-107-05
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit.
- Vendor: Rockwell Automation
- Equipment: Allen-Bradley Stratix Industrial Managed Ethernet Switch
- Vulnerabilities: Improper Input Validation, Resource Management Errors, 7PK – Errors, Improper Restriction of Operations within the Bounds of a Memory Buffer, Use of Externally-Controlled Format String.
## 2. RISK EVALUATION
Successful exploitation of these vuln
CISA ICS
Rockwell Automation Stratix and ArmorStratix Switches
cisa_ics·2018-04-25
Rockwell Automation Stratix and ArmorStratix Switches
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Rockwell Automation Stratix and ArmorStratix Switches
Last RevisedApril 25, 2018
Alert CodeICSA-18-107-04
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit.
- Vendor: Rockwell Automation
- Equipment: Allen-Bradley Stratix and ArmorStratix Switches
- Vulnerabilities: Improper Input Validation, Resource Management Errors, Improper Restriction of Operations within the Bounds of a Memory Buffer, Use of Externally-Controlled Format String.
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in loss
Cisco
Cisco IOS and IOS XE Software DHCP Version 4 Relay Denial of Service Vulnerability
vendor_cisco·2018-03-28·CVSS 8.6
CVE-2018-0174 [HIGH] CWE-20 Cisco IOS and IOS XE Software DHCP Version 4 Relay Denial of Service Vulnerability
Cisco IOS and IOS XE Software DHCP Version 4 Relay Denial of Service Vulnerability
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.
The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Cisco has released software updates that address th
Cisco
Cisco IOS and IOS XE Software DHCP Version 4 Relay Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0174 Cisco IOS and IOS XE Software DHCP Version 4 Relay Denial of Service Vulnerability
CVE-2018-0174: Cisco IOS and IOS XE Software DHCP Version 4 Relay Denial of Service Vulnerability
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates tha
GHSA
GHSA-qcqh-fmx4-f33r: A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remo
ghsa_unreviewed·2022-05-13
CVE-2018-0174 [HIGH] CWE-20 GHSA-qcqh-fmx4-f33r: A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remo
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuh91645.
VulnCheck
Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
vulncheck·2018·CVSS 8.6
CVE-2018-0174 [HIGH] CWE-20 Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Affected: Cisco IOS XE Software
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180328-dhcpr3.html
Remediation Due: 2022-03-17
No detection rules found.
No public exploits indexed.
Tenable
Tenable Research: February and March Vulnerability Disclosure Roundup
blogs_tenable·2018-04-13·CVSS 8.8
[HIGH] Tenable Research: February and March Vulnerability Disclosure Roundup
Blog / Research
Subscribe
# Tenable Research: February and March Vulnerability Disclosure Roundup
Tenable Research
April 13, 2018
4 Min Read
Tenable Research has a dedicated team that performs vulnerability research on software and hardware from third-party vendors. The goal is to discover zero-day vulnerabilities and work with vendors to get them addressed before hackers discover and exploit them.
This post provides an overview of all the vulnerabilities discovered by Tenable Research in February and March.
You can access all Tenable Research advisories here.
EMC VASA Virtual Appliance Default Credentials and Arbitrary File Upload
CVE ID: CVE-2018-1216, CVE-2018-1215
Nessus Plugin ID: 106849
Tenable Research Advisory: TRA-2018-03
Risk Factor: Critical
What do you need to know
Tenable
Tenable Research: February and March Vulnerability Disclosure Roundup
blogs_tenable·2018-04-13
Tenable Research: February and March Vulnerability Disclosure Roundup
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
[R1] Cisco IOS and IOS XE Multiple Memory Corruption Vulnerabilities
blogs_tenable·2018-03-28
[R1] Cisco IOS and IOS XE Multiple Memory Corruption Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://www.securityfocus.com/bid/103554http://www.securitytracker.com/id/1040591https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3https://www.tenable.com/security/research/tra-2018-06http://www.securityfocus.com/bid/103554http://www.securitytracker.com/id/1040591https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3https://www.tenable.com/security/research/tra-2018-06https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0174
2018-03-28
Published
2022-03-03
Added to CISA KEV
Exploited in the wild