CVE-2018-0197 — Improper Input Validation in Cisco IOS AND IOS XE Software

CWE-20 — Improper Input Validation4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 64.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco IOS AND IOS XE SoftwareCisco IOSCisco IOS XE
Timeline
PublishedOct 5
Latest updateMay 13

Description

A vulnerability in the VLAN Trunking Protocol (VTP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to corrupt the internal VTP database on an affected device and cause a denial of service (DoS) condition. The vulnerability is due to a logic error in how the affected software handles a subset of VTP packets. An attacker could exploit this vulnerability by sending VTP packets in a sequence that triggers a timeout in the VTP message proce…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDcisco/ios1060 versions+1059
▶NVDcisco/ios_xe134 versions+133

🔴Vulnerability Details

2
GHSA
GHSA-r7rx-2r34-f26f: A vulnerability in the VLAN Trunking Protocol (VTP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent↗2022-05-13
▶
CVEList
Cisco IOS and IOS XE Software VLAN Trunking Protocol Denial of Service Vulnerability↗2018-10-05
▶

📋Vendor Advisories

1
Cisco
Cisco IOS and IOS XE Software VLAN Trunking Protocol Denial of Service Vulnerability↗2018-09-26
▶
CVE-2018-0197 — Improper Input Validation in Cisco | cvebase