CVE-2018-0154

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A vulnerability exists in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) when running Cisco IOS Software. The issue, tracked as Cisco Bug ID CSCvd39267, stems from insufficient handling of VPN traffic and is assigned CWE-399. Successful exploitation can trigger a denial of service on the affected device, reflected in the CVSS 7.5 score emphasizing high availability impact without requiring authentication or user interaction.

An unauthenticated remote attacker can exploit the flaw by sending crafted VPN traffic to an affected device. A successful attack causes the device to hang or crash, resulting in a denial-of-service condition that disrupts VPN services and potentially other operations on the module.

The Cisco Security Advisory cisco-sa-20180328-dos, along with related notices on SecurityFocus and SecurityTracker, provides official details for affected releases and recommended actions. No information on observed in-the-wild exploitation is included in the supplied references.