CVE-2018-0174

HIGH KEV

Cisco Ios < 15.2\(4a\)ea5 - Improper Input Validation

Title source: rule

Description

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuh91645.

Scores

CVSS v3 8.6
EPSS 0.0542
EPSS Percentile 90.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Details

CISA KEV 2022-03-03
VulnCheck KEV 2022-03-03
InTheWild.io 2022-03-03
ENISA EUVD EUVD-2018-0997
CWE
CWE-20
Status published
Products (4)
cisco/ios 12.2\(33\)sre7a
cisco/ios < 15.2\(4a\)ea5
cisco/ios_xe 12.2\(33\)sre7a
cisco/ios_xe < 15.2\(4a\)ea5
Published Mar 28, 2018
KEV Added Mar 03, 2022
Tracked Since Feb 18, 2026