PT-2018-8798 · Cisco · Cisco Nexus 9000 Series Fabric Switches

Published 2018-07-18 · Updated 2019-10-09 · CVE-2018-0372

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series Fabric Switches in Application-Centric Infrastructure (ACI) Mode version 13.0(1k)

Description A vulnerability in the DHCPv6 feature could allow an unauthenticated, remote attacker to cause a Denial of Service (DoS) condition by sending a high number of malicious DHCPv6 packets, resulting in the device running low on system memory. This could lead to an eventual reboot of the affected device. The issue is due to improper memory management when DHCPv6 packets are received. The vulnerability only affects IPv6 protocol packets and can be exploited when unicast routing is enabled on the Bridge Domain (BD).

Recommendations For Cisco Nexus 9000 Series Fabric Switches in ACI Mode version 13.0(1k), consider disabling the DHCPv6 feature or restricting access to the affected device until a patch is available. Additionally, disabling unicast routing on the Bridge Domain (BD) could mitigate the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2018-0372

Affected Products

Cisco Nexus 9000 Series Fabric Switches

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-20180718-nexus-9000-dos · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0372 · Security Note
• http://securitytracker.com/id/1041348 · Note