Improper input validation in Cisco Nx-Os Software
CVE-2018-0395
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface on the targeted device. A successful exploit could allow the attacker to cause the switch to reload unexpectedly.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.008 (53.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cisco Nx-os Software — versions unspecified
- Cisco Firepower 4100 Series Next-generation Firewalls — versions unspecified
- Cisco Firepower_9300
- Cisco Firepower_extensible_operating_system — versions r231
- Cisco Nexus_7000_10-slot
- Cisco Nexus_7000_18-slot
- Cisco Nexus_7000_4-slot
- Cisco Nexus_7000_9-slot
- Cisco Nexus_7700_10-slot
- Cisco Nexus_7700_18-slot
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-0395?
- CVE-2018-0395 is a high-severity vulnerability in Cisco Nx-Os Software, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2018-10-17.
- How severe is CVE-2018-0395?
- High severity. CVSS v3 base score is 8.8 out of 10.