Cloudanix VulnDB

CVE-2018-0151

Critical · 9.8 CISA KEV

CVSS

9.8

EPSS

14.2%

Published

Mar 28, 2018

CISA due date

Mar 17, 2022

Cloudanix analysis

Act now SSVC: Attend

Attackers can remotely crash or take over certain Cisco network devices by sending specially made network packets, potentially disrupting entire networks.

Active In The Wild Wormable
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
Network Service
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Incorrect bounds checking on values in packets to UDP port 18999 triggers a buffer overflow in the QoS subsystem, allowing arbitrary code execution with elevated privileges or device reload.

Why it matters to the business

Successful exploitation can fully compromise network infrastructure devices, causing prolonged outages, unauthorized network control, and lateral movement; high urgency due to KEV listing with past CISA due date of 2022-03-17 and active exploitation in the wild.

How an attack unfolds

An attacker sends crafted UDP packets to port 18999 on a vulnerable Cisco IOS or IOS XE device; processing triggers the buffer overflow, enabling remote code execution or forced reload without authentication or transit traffic involvement.

How to fix it

Upgrade all affected Cisco IOS and IOS XE installations to the fixed releases provided in Cisco security advisory CSCvf73881; apply vendor patches immediately given KEV status.

How to confirm the fix worked

Confirm device software versions are updated to patched releases listed in the Cisco advisory; inspect QoS configuration and test UDP 18999 handling with benign traffic where feasible.

Typical attack path

  1. Scan for exposed Cisco IOS/IOS XE devices reachable on UDP 18999
  2. Craft and send malicious packets exploiting the bounds-checking flaw
  3. Trigger buffer overflow to obtain elevated code execution or induce reload
  4. Establish persistence or leverage for further network compromise or DoS

How to detect it

Search network flow and firewall logs for unexpected traffic to UDP port 18999; examine device syslogs and crash reports for QoS-related buffer issues or unexplained reloads coinciding with suspicious inbound packets.

What your security team should do

  • Prioritize patching of all Cisco IOS/IOS XE devices due to KEV inclusion and active exploitation
  • Block or restrict inbound UDP 18999 traffic at network edges where operationally possible
  • Enable logging for QoS subsystem and device reload events for ongoing monitoring
  • Review and apply Cisco Bug ID CSCvf73881 mitigations until upgrades complete

The record

A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 18999 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code on the affected device with elevated privileges. The attacker could also leverage this vulnerability to cause the device to reload, causing a temporary DoS condition while the device is reloading. The malicious packets must be destined to and processed by an affected device. Traffic transiting a device will not trigger the vulnerability. Cisco Bug IDs: CSCvf73881.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities