Cisco · Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches
CVE-2018-0155
Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability
Qué es
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.
CISA: A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 17 de marzo de 2022
Más fallos explotados de Cisco
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 14 oct 2026 | Relative Path Traversal | Secure Email Gateway | Crítica 9,8 | 2,2% |
| 30 sept 2026 | Hex Encoding | Catalyst SD-WAN Manager | Crítica 9,8 | 39% |
| 16 sept 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Crítica 10,0 | 76% |
| 14 sept 2026 | SQL Injection | Secure Email Gateway | Crítica 9,8 | 30% |
| 9 sept 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Crítica 10,0 | 88% |
| 11 ago 2026 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Alto 8,6 | 1,0% |
| 29 jul 2026 | Secure Firewall Management Center Use of Hard-coded Password | Secure Firewall Management Center (FMC) | Media 5,3 | 35% |
| 13 jul 2026 | Cross-Site Request Forgery | IOS | Alto 8,1 | 34% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.