CVE-2018-0173
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Severity Score
8.6
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
Yes
*KEV
Decision
-
*SSVC
Descriptions
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.
Una vulnerabilidad en la función de Cisco IOS Software y Cisco IOS XE Software que restaura la información de la opción 82 encapsulada en paquetes DHCPv4 (DHCP Version 4) podría permitir que un atacante remoto no autenticado provoque que un dispositivo afectado se recargue. Esto resulta en una condición de denegación de servicio (DoS) por Relay Reply. La vulnerabilidad existe debido a que el software afectado realiza validación incompleta de entradas de la información encapsulada de la opción 82 que recibe en los mensajes DHCPOFFER de los servidores DHCPv4. Un atacante podría explotar esta vulnerabilidad enviando un paquete DHCPv4 manipulado a un dispositivo afectado, que el dispositivo reenviaría posteriormente a un servidor DHCPv4. Cuando el software afectado procesa la información de la opción 82 que está encapsulada en la respuesta del servidor, podría ocurrir un error. Si se explota con éxito, podría permitir que el atacante consiga que el dispositivo afectado se reinicie, provocando una denegación de servicio. Cisco Bug IDs: CSCvg62754.
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-11-27 CVE Reserved
- 2018-03-28 CVE Published
- 2022-03-03 Exploited in Wild
- 2022-03-17 KEV Due Date
- 2024-07-25 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/103545 | Broken Link | |
| http://www.securitytracker.com/id/1040591 | Broken Link | |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 | Third Party Advisory | |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 | Third Party Advisory | |
| https://www.tenable.com/security/research/tra-2018-06 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2 | 2024-07-24 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4321 Integrated Services Router Search vendor "Cisco" for product "4321 Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4331 Integrated Services Router Search vendor "Cisco" for product "4331 Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4351 Integrated Services Router Search vendor "Cisco" for product "4351 Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4431 Integrated Services Router Search vendor "Cisco" for product "4431 Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4451-x Integrated Services Router Search vendor "Cisco" for product "4451-x Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1000 Series Route Processor \(rp2\) Search vendor "Cisco" for product "Asr 1000 Series Route Processor \(rp2\)" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1000 Series Route Processor \(rp3\) Search vendor "Cisco" for product "Asr 1000 Series Route Processor \(rp3\)" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1001-hx Search vendor "Cisco" for product "Asr 1001-hx" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1001-x Search vendor "Cisco" for product "Asr 1001-x" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1002-hx Search vendor "Cisco" for product "Asr 1002-hx" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1002-x Search vendor "Cisco" for product "Asr 1002-x" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | denali-16.3.4 Search vendor "Cisco" for product "Ios" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Cloud Services Router 1000v Search vendor "Cisco" for product "Cloud Services Router 1000v" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4321 Integrated Services Router Search vendor "Cisco" for product "4321 Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4331 Integrated Services Router Search vendor "Cisco" for product "4331 Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4351 Integrated Services Router Search vendor "Cisco" for product "4351 Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4431 Integrated Services Router Search vendor "Cisco" for product "4431 Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | 4451-x Integrated Services Router Search vendor "Cisco" for product "4451-x Integrated Services Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1000 Series Route Processor \(rp2\) Search vendor "Cisco" for product "Asr 1000 Series Route Processor \(rp2\)" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1000 Series Route Processor \(rp3\) Search vendor "Cisco" for product "Asr 1000 Series Route Processor \(rp3\)" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1001-hx Search vendor "Cisco" for product "Asr 1001-hx" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1001-x Search vendor "Cisco" for product "Asr 1001-x" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1002-hx Search vendor "Cisco" for product "Asr 1002-hx" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 1002-x Search vendor "Cisco" for product "Asr 1002-x" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | denali-16.3.4 Search vendor "Cisco" for product "Ios Xe" and version "denali-16.3.4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Cloud Services Router 1000v Search vendor "Cisco" for product "Cloud Services Router 1000v" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Armorstratix 5700 Search vendor "Rockwellautomation" for product "Allen-bradley Armorstratix 5700" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 5400 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 5400" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 5410 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 5410" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 5700 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 5700" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 8000 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 8000" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios Xe" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Armorstratix 5700 Search vendor "Rockwellautomation" for product "Allen-bradley Armorstratix 5700" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios Xe" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 5400 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 5400" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios Xe" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 5410 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 5410" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios Xe" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 5700 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 5700" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | <= 15.2\(6\)e0a Search vendor "Cisco" for product "Ios Xe" and version " <= 15.2\(6\)e0a" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 8000 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 8000" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | <= 15.2\(4a\)ea5 Search vendor "Cisco" for product "Ios" and version " <= 15.2\(4a\)ea5" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 8300 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 8300" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | <= 15.2\(4a\)ea5 Search vendor "Cisco" for product "Ios Xe" and version " <= 15.2\(4a\)ea5" | - |
Affected
| in | Rockwellautomation Search vendor "Rockwellautomation" | Allen-bradley Stratix 8300 Search vendor "Rockwellautomation" for product "Allen-bradley Stratix 8300" | - | - |
Safe
|