CVE-2018-0173

Cisco IOS and IOS XE Software Improper Input Validation

8.6 HIGHActively exploited (CISA KEV)EPSS 7.61%

Published28 Mar 2018
Added to CISA KEV3 Mar 2022
Remediation due17 Mar 2022

Description

A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Cisco iOS≤ 15.2\(4a\)ea5 · ≤ 15.2\(6\)e0a · denali-16.3.4

Cisco iOS XE≤ 15.2\(4a\)ea5 · ≤ 15.2\(6\)e0a · denali-16.3.4

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04Third Party AdvisoryUS Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05Third Party AdvisoryUS Government Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0173US Government Resource
https://www.tenable.com/security/research/tra-2018-06Third Party Advisory
http://www.securityfocus.com/bid/103545Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040591Broken LinkThird Party AdvisoryVDB Entry

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2018-0173 being actively exploited?

Yes. CVE-2018-0173 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Mar 2022.

How severe is CVE-2018-0173?

CVE-2018-0173 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 7.61% probability of exploitation.

Which products are affected by CVE-2018-0173?

Affected products include Cisco iOS, Cisco iOS XE.

How do I fix CVE-2018-0173?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2018-0173 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.