$ cve CVE-2018-0159 JSON

CVE-2018-0159 KEV

7.5

HIGH · CVSS 3.1 · EPSS 6.9% (pctl 94)

Patch first

On CISA KEV — known exploited in the wild, due 2022-03-17.

Description

A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.

Scoring

CVSS	7.5 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS	6.87% — more likely to be exploited than 94% of all CVEs
Weakness	CWE-20
On CISA KEV	yes — remediate by 2022-03-17
Public exploit	none known
Published	2018-03-28
Last modified	2026-06-17

CISA KEV

Name	Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability
Added	2022-03-03
Due	2022-03-17
Vendor / product	Cisco / IOS Software and Cisco IOS XE Software
Ransomware use	none reported

Affected (14)

Vendor	Product
cisco	asr 901-12c-f-d
cisco	asr 901-12c-ft-d
cisco	asr 901-4c-f-d
cisco	asr 901-4c-ft-d
cisco	asr 901-6cz-f-a
cisco	asr 901-6cz-f-d
cisco	asr 901-6cz-ft-a
cisco	asr 901-6cz-ft-d
cisco	ios
cisco	ios xe
cisco	me 3600x-24cx-m
cisco	me 3600x-24fs-m
cisco	me 3600x-24ts-m
cisco	me 3800x-24fs-m

References

→ the Explorer · watch your stack · NVD