PT-2018-3801 · Cisco · Cisco Ios Xe+2

Published 2018-03-28 · Updated 2025-01-27 · CVE-2018-0167

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS, Cisco IOS XE, and Cisco IOS XR Software (affected versions not specified)

Description The issue is related to multiple buffer overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of the affected software. An unauthenticated, adjacent attacker could exploit these vulnerabilities to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.

Recommendations For Cisco IOS Software, update to a version that includes the fix for the buffer overflow vulnerabilities in the LLDP subsystem. For Cisco IOS XE Software, update to a version that includes the fix for the buffer overflow vulnerabilities in the LLDP subsystem. For Cisco IOS XR Software, update to a version that includes the fix for the buffer overflow vulnerabilities in the LLDP subsystem. As a temporary workaround, consider disabling the LLDP protocol until a patch is available. Restrict access to the LLDP subsystem to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2022-04022

CVE-2018-0167

Affected Products

Cisco Ios

Cisco Ios Xe

Cisco Ios Xr

References · 12

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04022 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0167 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0167 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0167 · Note
• http://securityfocus.com/bid/103564 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 · Note
• https://t.me/cvenotify/108749 · Telegram Post
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 · Note
• http://securitytracker.com/id/1040586 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note