Cisco · IOS Software and Cisco IOS XE Software
CVE-2018-0158
Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability
De quoi s'agit-il
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.
CISA: A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.
Que faire
Apply updates per vendor instructions.
Échéance pour les agences fédérales américaines : 17 mars 2022
- Ajoutée à la liste de la CISA
- 3 mars 2022
- Publiée
- 28 mars 2018
- Gravité
- Élevé 8,6 CVSS 3.1
- Probabilité d'attaques dans les 30 prochains jours (EPSS)
- 7,2% dans les 5,7% les plus à risque de toutes les failles connues
- Faiblesse
- CWE-20
- Plus de détails
- NVD · CVE.org · CISA
Toutes les références (5)
Autres failles exploitées chez Cisco
| Ajouté | Faille | Produit | Gravité | Risque d'attaque |
|---|---|---|---|---|
| 3 mars 2022 | Smart Install Denial-of-Service | IOS Software and Cisco IOS XE Software | Élevé 7,5 | 9,4% |
| 3 mars 2022 | IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service | IOS Software and Cisco IOS XE Software | Élevé 7,5 | 6,9% |
| 14 oct. 2026 | Relative Path Traversal | Secure Email Gateway | Critique 9,8 | 2,2% |
| 30 sept. 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critique 9,8 | 39% |
| 16 sept. 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critique 10,0 | 76% |
| 14 sept. 2026 | SQL Injection | Secure Email Gateway | Critique 9,8 | 30% |
| 9 sept. 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Critique 10,0 | 88% |
| 11 août 2026 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Élevé 8,6 | 1,0% |
Sources : Known Exploited Vulnerabilities (CISA, domaine public), CVE records (cve.org) et EPSS (FIRST). Le risque d'attaque est l'estimation EPSS qu'une personne tente d'exploiter la faille dans les 30 prochains jours.