EXPOSURES › CVE-2018-0173
CVE-2018-0173
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco IOS and IOS XE Software suffered an unpatched improper input validation vulnerability in DHCPv4 packet handling that caused denial-of-service and was actively exploited in the wild.
Cisco's IOS and IOS XE Software failed to properly validate input in DHCPv4 packets, allowing attackers to trigger a denial-of-service condition. This unpatched vulnerability was actively exploited in the wild, demonstrating that known CVEs can remain unaddressed long enough to be weaponized. DIB organizations must ensure their network infrastructure is patched against known vulnerabilities and monitor for active exploitation in the KEV catalog.
Shame score — A known vulnerability remained unpatched long enough to be actively exploited in the wild, showing negligence in patch management and allowing attackers to weaponize a CVE.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |