CVE-2018-0151

An unauthenticated remote attacker could execute arbitrary code with elevated privileges in Cisco IOS and IOS XE QoS subsystems.

Cisco IOS and IOS XE software contained a remote code execution vulnerability in the QoS subsystem allowing unauthenticated attackers to execute arbitrary code with elevated privileges. This failure is critical for DIB organizations because it enables full system compromise, violates CMMC/NIST 800-171 requirements for protecting unclassified information, and highlights systemic issues in Cisco's historical patching of high-severity RCE flaws. Organizations must ensure all network infrastructure is patched to the latest versions and restrict access to network devices to prevent exploitation.

Shame score — A high-severity remote code execution vulnerability in foundational networking software that was actively exploited in the wild, reflecting systemic neglect of critical security flaws in widely deployed infrastructure.