CVE-2018-0395
HIGHCisco NX-OS and FXOS - Denial of Service via LLDP TLV Field Input Validation
Title source: llmDescription
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface on the targeted device. A successful exploit could allow the attacker to cause the switch to reload unexpectedly.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_cisco
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-fxnx-os-dos
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1041919
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/105674
Scores
CVSS v3
8.8
EPSS
0.0086
EPSS Percentile
54.0%
Attack Vector
ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-20
Status
published
Products (6)
cisco/firepower_extensible_operating_system
r231
cisco/nx-os
6.0\(4\)
cisco/nx-os
6.1\(3\)s2
cisco/nx-os
r231
cisco/nx-os
12.3\(1e\)
cisco/nx-os
3.2\(3d\)c
Published
Oct 17, 2018
Tracked Since
Feb 18, 2026