medium
6.5
CWE
287
Advisory Published
Updated

CVE-2018-0163

First published: Wed Mar 28 2018(Updated: )

A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass the authentication phase on an 802.1x multi-auth port. The vulnerability is due to a logic change error introduced into the code. An attacker could exploit this vulnerability by trying to access an 802.1x multi-auth port after a successful supplicant has authenticated. An exploit could allow the attacker to bypass the 802.1x access controls and obtain access to the network. Cisco Bug IDs: CSCvg69701.

Credit: ykramarz@cisco.com

Affected SoftwareAffected VersionHow to fix
Cisco IOS=15.4\(3\)m6
Cisco IOS=15.4\(3\)m6a
Cisco IOS=15.4\(3\)m7
Cisco IOS=15.4\(3\)m7a
Cisco IOS=15.4\(3\)m8
Cisco IOS=15.4\(3.0i\)m6
Cisco IOS=15.5\(3\)m3
Cisco IOS=15.5\(3\)m4
Cisco IOS=15.5\(3\)m4a
Cisco IOS=15.5\(3\)m4b
Cisco IOS=15.5\(3\)m4c
Cisco IOS=15.5\(3\)m5
Cisco IOS=15.5\(3\)m5a
Cisco IOS=15.5\(3\)m6
Cisco IOS=15.5\(3\)m6a
Cisco IOS=15.6\(1\)t2
Cisco IOS=15.6\(1\)t3
Cisco IOS=15.6\(2\)t1
Cisco IOS=15.6\(2\)t2
Cisco IOS=15.6\(2\)t3
Cisco IOS=15.6\(3\)m
Cisco IOS=15.6\(3\)m0a
Cisco IOS=15.6\(3\)m1
Cisco IOS=15.6\(3\)m1a
Cisco IOS=15.6\(3\)m1b
Cisco IOS=15.6\(3\)m2
Cisco IOS=15.6\(3\)m2a
Cisco IOS=15.6\(3\)m3
Cisco IOS=15.6\(3\)m3a
Cisco IOS=15.7\(3\)m
Cisco IOS=15.7\(3\)m0a
Cisco IOS=15.7\(3\)m1
Cisco IOS=15.7\(3\)m2
Cisco Connected Grid Routers
Cisco Connected Grid Router
Cisco 1905 Serial Integrated Services Router
Cisco 1906c Integrated Services Router
Cisco 1921 Integrated Services Router
Cisco 1941w Integrated Services Router
Cisco 1941w Integrated Services Router
Cisco Connected Grid Router
Cisco 2901 Integrated Services Router
Cisco ISR (Integrated Services Router)
Cisco 2911 Integrated Services Router
Cisco 2921 Integrated Services Router
Cisco 2951 Integrated Services Router
Cisco 3925 Integrated Services Router
Cisco 3925E Integrated Services Router
Cisco 3945 Integrated Services Router
Cisco 3945e Integrated Services Router
Cisco 5915 Embedded Service Router
Cisco 5921 Embedded Services Router
Cisco 5940 Embedded Services Router
Cisco 8000 Series Routers
Cisco 800 Series Routers
Cisco 809 Industrial Integrated Services Router Firmware
Cisco 812 3G Integrated Services Router
Cisco 812 3G Integrated Services Router
Cisco 819 Hardened Integrated Services Router
Cisco 819 Hardened Integrated Services Router
Cisco 819 Hardened Dual Radio 802.11n WiFi Integrated Services Router
Cisco 819 Hardened Dual Radio 802.11n WiFi Integrated Services Router
Cisco 819 Non-Hardened Secure Multi-Mode 4G LTE M2M ISR Router
Cisco 819 non-hardened 4G LTE M2M
Cisco 829 Industrial Integrated Services Router Firmware
Cisco 860vae-w Integrated Services Router
Cisco 861w Integrated Services Router
Cisco 861 Integrated Services Router
Cisco c866vae integrated services router
Cisco 867 Integrated Services Router
Cisco 880-voice Integrated Services Router
Cisco 881-CUBE Integrated Services Router
Cisco 881 3G Integrated Services Router
Cisco c881w Integrated Services Router
Cisco 881 Secure Fast Ethernet
Cisco c881w Integrated Services Router
Cisco 886va-cube Integrated Services Router
Cisco c886vaj Integrated Services Router
Cisco 886va-w Integrated Services Router
Cisco 886vag 3g Integrated Services Router
Cisco 887 multi-mode VDSL2/ADSL2+ POTS
Cisco 887va-cube Integrated Services Router
Cisco c887va Integrated Services Router
Cisco 887va-cube Integrated Services Router
Cisco 887vagw 3G Integrated Services Router
Cisco 887vagw 3G Integrated Services Router
Cisco 887vam-w Integrated Services Router
Cisco 887vagw 3G Integrated Services Router
Cisco 888e-cube Integrated Services Router
Cisco 888e-cube Integrated Services Router
Cisco 888e-cube Integrated Services Router
Cisco 888e-cube Integrated Services Router
Cisco 888EG 3G Integrated Services Router
Cisco 888w Integrated Services Router
Cisco 891-24x Integrated Services Router
Cisco 891-24x Integrated Services Router
Cisco 891w Integrated Services Router
Cisco 892 Integrated Services Router
Cisco 892f-cube Integrated Services Router
Cisco 892w Integrated Services Router
Cisco 896 multi-mode VDSL2/ADSL2+ ISDN
Cisco 897 multi-mode vdsl2/adsl2+ pots
Cisco 897 Multi-Mode VDSL2/ADSL2+ POTS Annex M
Cisco 898 Secure G.SHDSL EFM/ATM
Cisco c866vae Integrated Services Router
Cisco 867 Integrated Services Router
Cisco 881-CUBE Integrated Services Router
Cisco 881 3G Integrated Services Router
Cisco 886va-w Integrated Services Router
Cisco c886vaj Integrated Services Router
Cisco 887va-cube Integrated Services Router
Cisco 887vamg 3g Integrated Services Router
Cisco 888 Integrated Services Router
Cisco c888 Integrated Services Router
Cisco C891F Integrated Services Router
Cisco 891w Integrated Services Router
Cisco 892w Integrated Services Router
Cisco c896va Integrated Services Router
Cisco c897va-m Integrated Services Router
Cisco c897va-m Integrated Services Router
Cisco c897vaw Integrated Services Router
Cisco c897vam-w Integrated Services Router
Cisco c898ea Integrated Services Router
Cisco C899 Secure Gigabit Ethernet
Cisco VG204XM Analog Voice Gateway
Cisco VG350 Analog Voice Gateway
Cisco VG350 Analog Voice Gateway
Rockwell Automation Allen-Bradley Stratix 5900

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2018-0163?

    The severity of CVE-2018-0163 is considered high due to its potential to allow unauthenticated adjacent attackers to bypass authentication.

  • How do I fix CVE-2018-0163?

    To fix CVE-2018-0163, upgrade your Cisco IOS Software to the latest recommended version as provided in Cisco's security advisory.

  • Which Cisco IOS versions are affected by CVE-2018-0163?

    CVE-2018-0163 affects Cisco IOS versions 15.4(3)m6, 15.4(3)m7, 15.5(3)m3, 15.5(3)m4, 15.6(1)t2, 15.6(2)t1, and more.

  • What is the nature of the vulnerability in CVE-2018-0163?

    The nature of the vulnerability in CVE-2018-0163 is a logic error introduced in the 802.1x multiple-authentication feature.

  • Can CVE-2018-0163 affect network security?

    Yes, CVE-2018-0163 can significantly impact network security by allowing unauthorized access to network resources.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203