CVE-2018-0172: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow condition on the affected device, which will cause the device to reload and result in a DoS condition. Cisco Bug IDs: CSCvg62730.
Other sources
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-0172?
CVE-2018-0172 is a vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS and IOS XE Software that could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device.
What is the severity of CVE-2018-0172?
CVE-2018-0172 has a severity rating of 8.6/10, which is considered high.
How does CVE-2018-0172 affect Cisco IOS and IOS XE Software?
CVE-2018-0172 affects the DHCP option 82 encapsulation functionality of Cisco IOS and IOS XE Software, potentially allowing an attacker to cause a device to reload and result in a denial of service (DoS) condition.
How can I mitigate CVE-2018-0172 vulnerability?
To mitigate CVE-2018-0172, it is recommended to apply the necessary patches or updates provided by Cisco.
Where can I find more information about CVE-2018-0172?
More information about CVE-2018-0172 can be found on the following websites: [1] http://www.securityfocus.com/bid/103552, [2] http://www.securitytracker.com/id/1040591, [3] https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04.