HIGH CISA KEV

CVE-2018-0158

CVSS v3

8.6

HIGH

EPSS Score

11.3%

exploit probability

CISA KEV

Yes

known exploited

Exploitation

SSVC status

Description

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.

CISA Known Exploited Vulnerability

Date Added
3/3/2022
Patch Due Date
3/17/2022
Ransomware Use
Unknown

Technical details

Published
3/28/2018

Frequently asked questions

What is CVE-2018-0158?

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.

Is CVE-2018-0158 actively exploited?

Yes. CVE-2018-0158 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 3/17/2022.

What is the CVSS score for CVE-2018-0158?

CVE-2018-0158 has a CVSS v3 base score of 8.6 (HIGH severity).

Is CVE-2018-0158 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.