Resource exhaustion in Cisco Asr 9000v
CVE-2018-0418
A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input and validation checking on certain Precision Time Protocol (PTP) ingress traffic to an affected device. An attacker could exploit this vulnerability by injecting malformed traffic into an affected device. A successful exploit could allow the attacker to cause services on the device to become unresponsive, resulting in a DoS condition. Cisco Bug IDs: CSCvj22858.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.039 (90.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 90.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.040 · newest: 0.039 · change: -0.001
Affected products
Weakness classification (CWE)
References
- www.securitytracker.com/id/1041538 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/105185 (VDB Entry, Third Party Advisory, vdb-entry)
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-0418?
- CVE-2018-0418 is a high-severity vulnerability in Cisco Asr 9000v, classified under Uncontrolled Resource Consumption. CVSS score: 8.6/10. Published 2018-08-15.
- How severe is CVE-2018-0418?
- High severity. CVSS v3 base score is 8.6 out of 10.