CVE-2018-0175: cisco ios +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2018-0175

CVSS 8.0 · High KEV · sudah dieksploitasi EPSS 3,5%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada cisco ios, cisco ios xe +1 lainnya. Skor CVSS 3.1 8.0 (High) menurut NVD. Masuk katalog KEV CISA pada 3 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

Rincian

Terbit di NVD: 28 Maret 2018
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.0 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-134: Use of Externally-Controlled Format String
EPSS (30 hari): 3,5% peluang dieksploitasi; lebih tinggi dari 88,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
Masuk KEV: 3 Maret 2022
Tenggat CISA: 17 Maret 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cisco	ios	Versi 15.4(3)m4.1
cisco	ios xe	Versi 15.4(3)m4.1
cisco	ios xr	Versi 15.4(3)m4.1
cisco	ios	Semua versi hingga 15.2\(4a\)ea5
cisco	ios xe	Semua versi hingga 15.2\(4a\)ea5
cisco	ios	Semua versi hingga 15.2\(6\)e0a
cisco	ios xe	Semua versi hingga 15.2\(6\)e0a
cisco	ios	Semua versi hingga 15.6.3m1
cisco	ios xe	Semua versi hingga 15.6.3m1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp advisory vendor
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 advisory pihak ketiga · pemerintah AS
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 advisory pihak ketiga · pemerintah AS
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0175 pemerintah AS
http://www.securityfocus.com/bid/103564 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id/1040586 broken link · advisory pihak ketiga · vdb entry

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.