EXPOSURES › CVE-2018-0174
CVE-2018-0174
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco IOS XE DHCP option 82 improper input validation allows denial-of-service via unpatched, actively exploited vulnerability.
Cisco IOS XE Software suffered an improper input validation flaw in DHCP option 82 encapsulation, enabling denial-of-service attacks. This unpatched, actively exploited vulnerability (CVE-2018-0174) remains in the KEV database, indicating it is still being targeted in the wild. DIB organizations must ensure all network infrastructure is patched and monitored for active exploitation, as unpatched CVEs represent a severe compliance and operational risk.
Shame score — The vulnerability was actively exploited in the wild and remains unpatched for years, representing a negligent failure to address a known, high-severity flaw that continues to threaten network availability.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |