CVE-2018-0167

HIGH KEV

Cisco IOS, IOS XE, and IOS XR - Buffer Overflow in LLDP Subsystem

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-0167 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022.

Description

Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.

References (7)

Core 7
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040586
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/103564

Scores

CVSS v3 8.8
EPSS 0.0121
EPSS Percentile 79.5%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-03-03
VulnCheck KEV 2022-03-03
InTheWild.io 2022-03-03
ENISA EUVD EUVD-2018-0990
CWE
CWE-119
Status published
Products (5)
cisco/ios 5.2.0.base
cisco/ios < 15.6.3m1
cisco/ios_xe 5.2.0.base
cisco/ios_xe < 15.6.3m1
cisco/ios_xr 4.1 - 5.1.3
Published Mar 28, 2018
KEV Added Mar 03, 2022
Tracked Since Feb 18, 2026