What is CVE-2018-0315?

CVE-2018-0315 is a critical-severity vulnerability in Cisco iOS Xe, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2018-06-07.

How severe is CVE-2018-0315?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Cisco iOS Xe

CVE-2018-0315

A vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device or cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect memory operations that the affected software performs when the software parses a username during login authentication. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device or cause the affected device to reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are running Cisco IOS XE Software Release Fuji 16.7.1 or Fuji 16.8.1 and are configured to use AAA for login authentication. Cisco Bug IDs: CSCvi25380.

Vulnerability class: Buffer Overflow

Published 2018-06-07 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.078 (94.5th percentile), scored 2026-10-04.

Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.078 · newest: 0.078 · change: 0.000

Affected products

Cisco iOS Xe — versions 16.7.1, 16.8.1
Cisco iOS Xe Unknown — versions Cisco IOS XE unknown

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606… (Vendor Advisory)
www.securityfocus.com/bid/104410 (VDB Entry, Third Party Advisory, vdb-entry)
www.securitytracker.com/id/1041086 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)

Frequently asked questions

What is CVE-2018-0315?: CVE-2018-0315 is a critical-severity vulnerability in Cisco iOS Xe, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2018-06-07.
How severe is CVE-2018-0315?: Critical severity. CVSS v3 base score is 9.8 out of 10.