CVE-2018-0154
Published: 28 March 2018
Summary
CVE-2018-0154 is a high-severity an unspecified weakness vulnerability in Cisco Ios. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-7 (Boundary Protection).
Deeper analysis
A vulnerability exists in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) when running Cisco IOS Software. The issue, tracked as Cisco Bug ID CSCvd39267, stems from insufficient handling of VPN traffic and is assigned CWE-399. Successful exploitation can trigger a denial of service on the affected device, reflected in the CVSS 7.5 score emphasizing high availability impact without requiring authentication or user interaction.
An unauthenticated remote attacker can exploit the flaw by sending crafted VPN traffic to an affected device. A successful attack causes the device to hang or crash, resulting in a denial-of-service condition that disrupts VPN services and potentially other operations on the module.
The Cisco Security Advisory cisco-sa-20180328-dos, along with related notices on SecurityFocus and SecurityTracker, provides official details for affected releases and recommended actions. No information on observed in-the-wild exploitation is included in the supplied references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-0977
Vulnerability details
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is…
more
due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to hang or crash, resulting in a DoS condition. Cisco Bug IDs: CSCvd39267.
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires mechanisms to protect against or limit effects of DoS attacks from crafted network traffic targeting the VPN crypto engine.
Enforces boundary controls and traffic filtering that can block or rate-limit the unauthenticated crafted VPN packets before they reach the vulnerable ISM-VPN module.
Requires validation of input data, which would address the insufficient handling of malformed VPN traffic that triggers the crash (CSCvd39267).