CVE-2018-15373

Cisco IOS and IOS XE Software Cisco Discovery Protocol Denial of Service Vulnerability

Severity Score

7.4

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust memory on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper memory handling by the affected software when the software processes high rates of Cisco Discovery Protocol packets that are sent to a device. An attacker could exploit this vulnerability by sending a high rate of Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to exhaust memory on the affected device, resulting in a DoS condition.

Una vulnerabilidad en la implementación de la funcionalidad Cisco Discovery Protocol en Cisco IOS Software y Cisco IOS XE Software podría permitir que un atacante adyacente sin autenticar agote la memoria de un dispositivo afectado, provocando una denegación de servicio (DoS) en consecuencia. La vulnerabilidad se debe a la gestión incorrecta de la memoria por parte del software afectado cuando el software procesa grandes volúmenes de paquetes Cisco Discovery Protocol que se envían a un dispositivo. Un atacante podría explotar esta vulnerabilidad enviando un gran volumen de paquetes Cisco Discovery Protocol a un dispositivo afectado. Su explotación con éxito podría permitir que el atacante agote la memoria en el dispositivo afectado y provoque una denegación de servicio (DoS).

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Adjacent

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-08-17 CVE Reserved
2018-10-05 CVE Published
2024-03-28 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-399: Resource Management Errors
CWE-770: Allocation of Resources Without Limits or Throttling

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/105413	Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-094-03	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cdp-dos	2019-10-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Ios Search vendor "Cisco" for product "Ios"				15.5\(3\)s3.16 Search vendor "Cisco" for product "Ios" and version "15.5\(3\)s3.16"		-		Affected
Cisco Search vendor "Cisco"		Ios Xe Search vendor "Cisco" for product "Ios Xe"				15.5\(3\)s3.16 Search vendor "Cisco" for product "Ios Xe" and version "15.5\(3\)s3.16"		-		Affected