Cloudanix VulnDB

CVE-2018-0158

High · 8.6 CISA KEV

CVSS

8.6

EPSS

7.2%

Published

Mar 28, 2018

CISA due date

Mar 17, 2022

Cloudanix analysis

Act now SSVC: Attend

Attackers can send special messages that make certain Cisco network devices run out of memory and restart, knocking networks offline until fixed.

Active In The Wild
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Incorrect processing of crafted IKEv2 packets in the IKEv2 module causes continuous memory consumption leading to eventual device reload and denial of service.

Why it matters to the business

Network devices become unavailable causing prolonged outages for VPN and routing services; the issue is listed in CISA KEV with a past remediation deadline and remains actively exploited in the wild.

How an attack unfolds

An unauthenticated remote attacker sends specially crafted IKEv2 packets to a vulnerable Cisco IOS or IOS-XE device; the packets trigger a memory leak that grows until the device exhausts resources and reloads, resulting in denial of service. Active exploitation has been observed in the wild against internet-exposed devices.

How to fix it

Upgrade affected Cisco IOS and IOS-XE releases to the fixed versions that resolve CSCvf22394; where upgrades are not immediately possible, apply vendor-recommended workarounds such as IKEv2 access controls or disabling IKEv2 on untrusted interfaces.

How to confirm the fix worked

Verify device software version against the fixed releases for CSCvf22394; monitor memory utilization and reload counters before and after changes; confirm IKEv2 packet handling behavior matches patched code.

Typical attack path

  1. Scan for exposed Cisco IOS or IOS-XE devices listening on IKEv2 ports
  2. Send crafted IKEv2 packets to trigger the memory leak
  3. Observe progressive memory exhaustion and eventual device reload
  4. Repeat or maintain traffic to sustain denial of service

How to detect it

Review IKEv2-related logs and memory statistics on Cisco devices for sustained increases without corresponding legitimate session growth; correlate with external traffic on UDP port 500 or 4500 from untrusted sources; examine crashinfo files for indicators of IKEv2 packet processing faults.

What your security team should do

  • Immediately prioritize patching of all KEV-listed Cisco IOS and IOS-XE devices due to the past CISA deadline and confirmed in-the-wild exploitation
  • Restrict IKEv2 exposure to trusted sources via ACLs until upgrades complete
  • Audit device inventory for all listed affected models including ASR series and Stratix 5900
  • Establish monitoring for memory leaks and unexpected reloads on remaining unpatched systems

The record

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities