CVE-2018-0161

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software on specific Catalyst switch models allows an authenticated remote attacker to trigger a denial of service condition. The flaw, tracked as CSCvd89541 and described as a GET MIB Object ID Denial of Service Vulnerability, occurs when the software processes an SNMP read request containing the ciscoFlashMIB object identifier. Affected devices include Cisco Catalyst 2960-L Series Switches and Cisco Catalyst Digital Building Series Switches (8P and 8U models) running vulnerable IOS releases and configured for SNMPv2 or SNMPv3.

An attacker with valid SNMP credentials can exploit the issue by issuing a crafted SNMP GET request for the ciscoFlashMIB OID. Successful exploitation causes the device to experience a SYS-3-CPUHOG condition and restart, producing a denial of service. The CVSS 3.1 score of 6.3 reflects the need for low-privileged network access combined with high attack complexity and a scope change affecting availability.

The referenced Cisco Security Advisory (cisco-sa-20180328-snmp) and associated security trackers provide details on vulnerable software releases along with recommended mitigation steps, including software updates that address the SNMP processing flaw. No information on observed in-the-wild exploitation is supplied in the source data.