Cisco · IOS Software
CVE-2018-0154
Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability
Qué es
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to hang or crash, resulting in a DoS condition. Cisco Bug IDs: CSCvd39267.
CISA: A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 17 de marzo de 2022
Más fallos explotados de Cisco
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 3 mar 2022 | SNMP Remote Code Execution | IOS software | Alto 8,8 | 7,3% |
| 3 mar 2022 | Resource Management Errors | IOS Software | Media 6,3 | 4,1% |
| 3 mar 2022 | Denial-of-Service | IOS Software | Media 6,8 | 4,9% |
| 3 mar 2022 | Denial-of-Service | IOS Software | Media 6,8 | 4,9% |
| 3 mar 2022 | Network Address Translation Denial-of-Service | IOS software | Alto 7,5 | 7,1% |
| 3 mar 2022 | for Cisco Integrated Services Routers Denial-of-Service | IOS software | Media 6,5 | 2,2% |
| 3 mar 2022 | Common Industrial Protocol Request Denial-of-Service | IOS software | Alto 7,5 | 7,1% |
| 3 mar 2022 | Common Industrial Protocol Request Denial-of-Service | IOS software | Alto 7,5 | 7,1% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.