Cloudanix VulnDB

CVE-2018-0161

Medium · 6.3 CISA KEV

CVSS

6.3

EPSS

4.1%

Published

Mar 28, 2018

CISA due date

Mar 17, 2022

Cloudanix analysis

Act now SSVC: Attend

Certain older Cisco network switches can be crashed remotely by an attacker who already knows the management password, causing sudden network outages until the devices reboot.

Active In The Wild
Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

An authenticated remote attacker can send an SNMP GET request for the ciscoFlashMIB OID on vulnerable Cisco IOS devices, triggering a resource exhaustion condition (SYS-3-CPUHOG) that forces an unplanned device restart.

Why it matters to the business

Network switches experience sudden reboots that interrupt connectivity, potentially halting business operations across affected sites; the vulnerability remains actively exploited in the wild with a past CISA remediation deadline, increasing urgency for organizations still running unpatched legacy Cisco Catalyst hardware.

How an attack unfolds

An attacker possessing valid SNMPv2 or SNMPv3 credentials crafts and sends a read request targeting the ciscoFlashMIB object identifier; the IOS SNMP subsystem enters a high-CPU loop, resulting in a device reboot that disrupts all traffic forwarding.

How to fix it

Apply the latest fixed Cisco IOS release for each affected Catalyst model once available; restrict SNMP access to trusted management stations only; consider disabling SNMPv2/v3 on devices that do not require it.

How to confirm the fix worked

Confirm SNMP service exposure via network scans, review device logs for absence of SYS-3-CPUHOG after simulated GET requests, and verify IOS version against Cisco advisory lists.

Typical attack path

  1. Obtain valid SNMP credentials for the target device
  2. Send an SNMP GET request containing the ciscoFlashMIB OID
  3. Trigger CPUHOG condition leading to immediate device restart

How to detect it

Search device syslog and SNMP logs for repeated GET requests referencing ciscoFlashMIB combined with SYS-3-CPUHOG messages; correlate with authentication events from management stations.

  • ciscoFlashMIB
  • SYS-3-CPUHOG
  • SNMP GET request for ciscoFlashMIB OID

What your security team should do

  • Immediately inventory all listed Catalyst models and prioritize upgrades or SNMP hardening
  • Implement network ACLs limiting SNMP traffic to authorized management hosts
  • Monitor device uptime and syslog for CPUHOG events as part of incident response

The record

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability is due to a condition that could occur when the affected software processes an SNMP read request that contains a request for the ciscoFlashMIB object ID (OID). An attacker could trigger this vulnerability by issuing an SNMP GET request for the ciscoFlashMIB OID on an affected device. A successful exploit could cause the affected device to restart due to a SYS-3-CPUHOG. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS Software and are configured to use SNMP Version 2 (SNMPv2) or SNMP Version 3 (SNMPv3): Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P, Cisco Catalyst Digital Building Series Switches 8U. Cisco Bug IDs: CSCvd89541.

Affected packages

Ecosystem Package Introduced Fixed