What is CVE-2018-0255?

CVE-2018-0255 is a high-severity vulnerability in Cisco iOS, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2018-04-19.

How severe is CVE-2018-0255?

High severity. CVSS v3 base score is 8.8 out of 10.

CSRF in Cisco iOS

CVE-2018-0255

A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to insufficient CSRF protection by the device manager web interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow the attacker to submit arbitrary requests to an affected device via the device manager web interface with the privileges of the user. This vulnerability affects the following Cisco Industrial Ethernet (IE) Switches if they are running a vulnerable release of Cisco IOS Software: IE 2000 Series, IE 2000U Series, IE 3000 Series, IE 3010 Series, IE 4000 Series, IE 4010 Series, IE 5000 Series. Cisco Bug IDs: CSCvc96405.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2018-04-19 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.009 (57.8th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 57.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: -0.000

Affected products

Cisco iOS — versions 15.2\(5\)e, 15.2(5)e
Cisco Industrial Ethernet Switches — versions Cisco Industrial Ethernet Switches

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

www.securitytracker.com/id/1040715 (VDB Entry, Third Party Advisory, vdb-entry)
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418… (Vendor Advisory)

Frequently asked questions

What is CVE-2018-0255?: CVE-2018-0255 is a high-severity vulnerability in Cisco iOS, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2018-04-19.
How severe is CVE-2018-0255?: High severity. CVSS v3 base score is 8.8 out of 10.