CVE-2018-0180
Cisco IOS Software Denial-of-Service Vulnerability
Description
CVE-2018-0180 is a medium-severity denial of service vulnerability affecting Cisco IOS Software. A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 1.28% (79.4th percentile), this vulnerability has a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios | 15.3\(00.00.19\)sy; 15.4\(01\)ia001.100; 15.6\(01.22\)t; 15.4\(03\)m4.1; 15.4\(2\)cg; 15.4\(2\)t; 15.4\(3\)m |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
References
- http://www.securityfocus.com/bid/103556(Broken Link, Third Party Advisory, VDB Entry)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-slogin(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0180(US Government Resource)
Weakness Type
CWE-399
This vulnerability is classified under CWE-399. For detailed information about this weakness type, consult the MITRE CWE database.
Learn more: CWE-399
Impact Analysis
CVE-2018-0180 carries a CVSS 3.1 score of 5.9 (MEDIUM), indicating a moderate-severity threat. The vulnerability is exploitable over the network though attack complexity is high and requires no authentication. Successful exploitation can cause complete service disruption. Organizations running affected IOS Software deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2018-0180 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 1.28% (79.4th percentile) indicates a measurable probability of exploitation. Federal agencies were required to remediate this vulnerability by 2022-03-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (cisco ios 15.3(00.00.19)sy; 15.4(01)ia001.100; 15.6(01.22)t; 15.4(03)m4.1; 15.4(2)cg; 15.4(2)t; 15.4(3)m) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2018-0180 affects Cisco IOS Software. A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The CVSS score of 5.9 reflects a moderate vulnerability, but its inclusion in the KEV catalog confirms real-world exploitation risk.
Frequently Asked Questions
Is CVE-2018-0180 being actively exploited?
Yes. CVE-2018-0180 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 1.28% (79.4th percentile) further indicates a measurable exploitation probability.
What products are affected by CVE-2018-0180?
CVE-2018-0180 affects Cisco IOS Software. Specifically affected products include: cisco ios (15.3(00.00.19)sy; 15.4(01)ia001.100; 15.6(01.22)t; 15.4(03)m4.1; 15.4(2)cg; 15.4(2)t; 15.4(3)m).
How do I fix CVE-2018-0180?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2018-0180?
CVE-2018-0180 has a CVSS 3.1 score of 5.9 (MEDIUM). While rated as medium severity, its presence in the KEV catalog confirms it is being actively exploited and should be remediated promptly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.