PT-2018-2104 · Cisco · Cisco Ios Xe

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-0480

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the errdisable per VLAN feature could allow an unauthenticated, adjacent attacker to cause the device to crash, leading to a denial of service (DoS) condition. The issue is due to a race condition that occurs when the VLAN and port enter an errdisabled state, resulting in an incorrect state in the software. An attacker could exploit this by sending frames that trigger the errdisable condition, potentially causing the affected device to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2019-00055

CVE-2018-0480

Affected Products

Cisco Ios Xe

References · 7

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-errdisable · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0480 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0480 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00055 · Security Note
• http://securityfocus.com/bid/105400 · Note
• https://securityfocus.com/bid/105400/info · Note
• http://securitytracker.com/id/1041737 · Note