Improper input validation in Cisco Nx-Os Software
CVE-2018-0395
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface on the targeted device. A successful exploit could allow the attacker to cause the switch to reload unexpectedly.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Cisco Nx-Os Software — versions unspecified
- Cisco Firepower 4100 Series Next-Generation Firewalls — versions unspecified
- Cisco Firepower 9300
- Cisco Firepower Extensible Operating System — versions r231
- Cisco Nexus 7000 10-Slot
- Cisco Nexus 7000 18-Slot
- Cisco Nexus 7000 4-Slot
- Cisco Nexus 7000 9-Slot
- Cisco Nexus 7700 10-Slot
- Cisco Nexus 7700 18-Slot
Weakness classification (CWE)
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017… (vendor-advisory, Vendor Advisory)
- www.securitytracker.com/id/1041919 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/105674 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-0395?
- CVE-2018-0395 is a high-severity vulnerability in Cisco Nx-Os Software, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2018-10-17.
- How severe is CVE-2018-0395?
- High severity. CVSS v3 base score is 8.8 out of 10.