Data handling in Cisco IOS XE - CVE-2018-0177
Published: March 30, 2018
Vulnerability identifier: #VU11353
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-0177
CWE-ID: CWE-19
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to cause high CPU utilization, traceback messages, or cause DoS condition on the target system.
The weakness exists in the IP Version 4 (IPv4) processing code due to incorrect processing of certain IPv4 packets. A remote attacker can send specially crafted IPv4 packets to an IPv4 address, trigger high CPU utilization, traceback messages, or cause the service to crash.
The weakness exists in the IP Version 4 (IPv4) processing code due to incorrect processing of certain IPv4 packets. A remote attacker can send specially crafted IPv4 packets to an IPv4 address, trigger high CPU utilization, traceback messages, or cause the service to crash.
Affected software
Cisco IOS XE
How to mitigate CVE-2018-0177
Update to versions 16.5.2, 16.5.1a, 16.3.4, 16.6(0.163), 16.5(1.25) or 16.3(3.26).