CVE-2018-0159
High · 7.5 CISA KEVCVSS
7.5
EPSS
6.9%
Published
Mar 28, 2018
CISA due date
Mar 17, 2022
Cloudanix analysis
Attackers can remotely crash certain Cisco network devices by sending specially crafted messages, knocking networks offline until the devices restart.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Trivial
- Impact
- Denial Of Service
- Component
- Network Service
- Class
- Denial of service
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Medium
What it actually does
Improper validation of specific IKEv1 packets during negotiation allows an unauthenticated remote attacker to trigger a device reload in affected Cisco IOS and IOS XE implementations.
Why it matters to the business
Successful remote attacks can force critical network devices offline, causing widespread connectivity loss and operational downtime; the vulnerability remains actively exploited in the wild with a past CISA remediation deadline.
How an attack unfolds
An attacker locates an exposed IKEv1 endpoint on a vulnerable Cisco device, initiates a standard IKE negotiation, and injects specially crafted IKEv1 packets that bypass validation checks, forcing an immediate reload and denial of service.
How to fix it
Upgrade affected Cisco IOS and IOS XE releases to patched versions that correctly validate IKEv1 packets; where upgrades are not immediately feasible, apply available workarounds such as IKEv1 access controls or migration to IKEv2.
How to confirm the fix worked
Verify device software version against Cisco security advisories, confirm absence of the CSCuj73916 condition in release notes, and test IKEv1 negotiation behavior under controlled conditions to ensure reloads no longer occur.
Typical attack path
- Scan for or enumerate Cisco IOS/IOS XE devices listening on UDP port 500 for IKEv1
- Begin an IKEv1 negotiation with the target
- Transmit crafted IKEv1 packets containing malformed payloads
- Trigger the reload condition resulting in DoS
How to detect it
Review device logs for unexpected reloads during active IKE negotiations, examine syslog and crashinfo files for IKEv1 packet processing errors, and correlate with network flow data showing inbound IKE traffic from untrusted sources.
What your security team should do
- Immediately inventory all Cisco IOS and IOS XE devices and prioritize upgrades due to KEV status and active exploitation
- Apply vendor-recommended mitigations or disable IKEv1 where possible until patches are deployed
- Monitor for device reload events correlated with IKE traffic and update incident response playbooks
The record
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|