Cloudanix VulnDB

CVE-2018-0154

High · 7.5 CISA KEV

CVSS

7.5

EPSS

7.1%

Published

Mar 28, 2018

CISA due date

Mar 17, 2022

Cloudanix analysis

Act now SSVC: Attend

Attackers can remotely crash certain Cisco routers that handle VPN connections, knocking entire networks offline until the devices are restarted.

Active In The Wild
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient handling of crafted VPN traffic in the crypto engine of ISM-VPN modules causes the affected Cisco IOS device to hang or crash.

Why it matters to the business

Remote attackers can trigger denial of service on enterprise routers, leading to extended network outages, VPN connectivity loss, and operational disruption; the vulnerability remains actively exploited in the wild more than eight years after disclosure with a CISA remediation deadline that has long passed.

How an attack unfolds

An unauthenticated remote attacker sends specially crafted VPN packets targeting the ISM-VPN crypto engine; the malformed traffic triggers a crash or hang without requiring authentication or user interaction, and known threat activity confirms successful exploitation in the wild.

How to fix it

Upgrade affected Cisco IOS releases to patched versions that resolve CSCvd39267; where upgrades are not immediately possible, apply traffic filtering or disable the ISM-VPN module as temporary mitigation.

How to confirm the fix worked

Verify IOS version against Cisco security advisories for CSCvd39267; monitor device stability under simulated VPN load and confirm absence of crash signatures in logs after applying fixes.

Typical attack path

  1. Scan for exposed Cisco IOS devices with ISM-VPN modules
  2. Craft and transmit malicious VPN traffic to the target
  3. Trigger device hang or crash resulting in DoS
  4. Maintain or repeat traffic to prolong outage

How to detect it

Review router crash logs and syslog for crypto engine faults or unexpected reloads; inspect network flows for high volumes of unusual VPN protocol packets directed at affected devices.

  • CSCvd39267
  • crypto engine
  • ISM-VPN
  • %CRYPTO_ENGINE-

What your security team should do

  • Prioritize patching or mitigation on all internet-facing and VPN-terminating devices due to KEV status and active exploitation
  • Implement network ACLs or firewall rules to drop anomalous VPN traffic
  • Enable logging of crypto engine events and configure alerts for unexpected reloads
  • Conduct inventory of all listed affected router models and schedule upgrades

The record

A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to hang or crash, resulting in a DoS condition. Cisco Bug IDs: CSCvd39267.

Affected packages

Ecosystem Package Introduced Fixed