Actively exploited · Published Mar 28, 2018 · Assigned by cisco

CVE-2018-0167

High 8.8 Exploited

In plain English

A high-severity memory corruption in Cisco IOS, IOS XE, and IOS XR. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)3.4%top 11.2% of all CVEs

Exploited in the wildYesCISA KEV since Mar 3, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 17, 2022.

Official description

Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.

Affected products (as reported)

Vendor	Product	Versions
n/a	Cisco IOS, IOS XE, and IOS XR	Cisco IOS, IOS XE, and IOS XR

Weakness: CWE-119 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp x_refsource_CONFIRM
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 x_refsource_MISC
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 x_refsource_MISC
1040586 vdb-entry, x_refsource_SECTRACK
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 x_refsource_MISC
103564 vdb-entry, x_refsource_BID
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0167 government-resource