peter bassill · operator
$ cve CVE-2018-0175 JSON

CVE-2018-0175 KEV

8.0
HIGH · CVSS 3.1 · EPSS 3.5% (pctl 89)

Patch first

On CISA KEV — known exploited in the wild, due 2022-03-17.

Description

Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

Scoring

CVSS8.0 (HIGH, v3.1)
VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS3.48% — more likely to be exploited than 89% of all CVEs
WeaknessCWE-119
On CISA KEVyes — remediate by 2022-03-17
Public exploitnone known
Published2018-03-28
Last modified2026-06-17

CISA KEV

NameCisco IOS, XR, and XE Software Buffer Overflow Vulnerability
Added2022-03-03
Due2022-03-17
Vendor / productCisco / IOS, XR, and XE Software
Ransomware usenone reported

Affected (10)

VendorProduct
ciscoios
ciscoios xe
ciscoios xr
rockwellautomationallen-bradley armorstratix 5700
rockwellautomationallen-bradley stratix 5400
rockwellautomationallen-bradley stratix 5410
rockwellautomationallen-bradley stratix 5700
rockwellautomationallen-bradley stratix 5900 services router
rockwellautomationallen-bradley stratix 8000
rockwellautomationallen-bradley stratix 8300 industrial managed ethernet switch

References

→ the Explorer  ·  watch your stack  ·  NVD