CVE-2018-0167
high · 8.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply updates per vendor instructions.
Added 2022-03-03Remediation due 2022-03-17
Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.
8.8
CVSS
3.4%
EPSS (exploit prob.)
88th
EPSS percentile
2018-03-28
Published
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | ios | 5.2.0.base |
| cisco | ios_xe | 5.2.0.base |
| cisco | ios_xr | >= 4.1, < 5.1.3 |
| cisco | asr_9001 | all versions |
| cisco | asr_9006 | all versions |
| cisco | asr_9010 | all versions |
| cisco | asr_9904 | all versions |
| cisco | asr_9906 | all versions |
| cisco | asr_9910 | all versions |
| cisco | asr_9912 | all versions |
| cisco | asr_9922 | all versions |
| cisco | ios | <= 15.6.3m1 |
| cisco | ios_xe | <= 15.6.3m1 |
| rockwellautomation | allen-bradley_stratix_5900 | all versions |
| cisco | ios | <= 15.2\(6\)e0a |
| cisco | ios_xe | <= 15.2\(6\)e0a |
| rockwellautomation | allen-bradley_armorstratix_5700 | all versions |
| rockwellautomation | allen-bradley_stratix_5400 | all versions |
| rockwellautomation | allen-bradley_stratix_5410 | all versions |
| rockwellautomation | allen-bradley_stratix_5700 | all versions |
| rockwellautomation | allen-bradley_stratix_8000 | all versions |
| cisco | ios | <= 15.2\(4a\)ea5 |
| cisco | ios_xe | <= 15.2\(4a\)ea5 |
| rockwellautomation | allen-bradley_stratix_8300 | all versions |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/103564
- http://www.securitytracker.com/id/1040586
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp
- http://www.securityfocus.com/bid/103564
- http://www.securitytracker.com/id/1040586
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0167
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-0167