CVE-2018-0282: Cisco IOS and IOS XE Software TCP Denial of Service Vulnerability

Published Jan 10, 2019

Updated

A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a state condition between the socket state and the transmission control block (TCB) state. While this vulnerability potentially affects all TCP applications, the only affected application observed so far is the HTTP server. An attacker could exploit this vulnerability by sending specific HTTP requests at a sustained rate to a reachable IP address of the affected software. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition on an affected device.

Affected Software

149 affected components

cisco IOS=15.2\(2\)e4

Cisco IOS XE

cisco Catalyst 2960-plus 24lc-l

cisco Catalyst 2960-plus 24lc-s

cisco Catalyst 2960-plus 24pc-l

cisco Catalyst 2960-plus 24pc-s

cisco Catalyst 2960-plus 24tc-l

cisco Catalyst 2960-plus 24tc-s

cisco Catalyst 2960-plus 48pst-l

cisco Catalyst 2960-plus 48pst-s

cisco Catalyst 2960-plus 48tc-l

cisco Catalyst 2960-plus 48tc-s

cisco Catalyst 2960c-12pc-l

cisco Catalyst 2960c-8pc-l

cisco Catalyst 2960c-8tc-l

cisco Catalyst 2960c-8tc-s

cisco Catalyst 2960cg-8tc-l

cisco Catalyst 2960cpd-8pt-l

cisco Catalyst 2960cpd-8tt-l

cisco Catalyst 2960s-24pd-l

cisco Catalyst 2960s-24ps-l

cisco Catalyst 2960s-24td-l

cisco Catalyst 2960s-24ts-l

cisco Catalyst 2960s-48fpd-l

cisco Catalyst 2960s-48fps-l

cisco Catalyst 2960s-48lpd-l

cisco Catalyst 2960s-48lps-l

cisco Catalyst 2960s-48td-l

cisco Catalyst 2960s-48ts-l

cisco Catalyst 2960s-48ts-s

cisco Catalyst 2960s-f24ps-l

cisco Catalyst 2960s-f24ts-l

cisco Catalyst 2960s-f24ts-s

cisco Catalyst 2960s-f48fps-l

cisco Catalyst 2960s-f48lps-l

cisco Catalyst 2960s-f48ts-l

cisco Catalyst 2960s-f48ts-s

cisco Catalyst 2960x-24pd-l

cisco Catalyst 2960x-24ps-l

cisco Catalyst 2960x-24psq-l

cisco Catalyst 2960x-24td-l

cisco Catalyst 2960x-24ts-l

cisco Catalyst 2960x-24ts-ll

cisco Catalyst 2960x-48fpd-l

cisco Catalyst 2960x-48fps-l

cisco Catalyst 2960x-48lpd-l

cisco Catalyst 2960x-48lps-l

cisco Catalyst 2960x-48td-l

cisco Catalyst 2960x-48ts-l

cisco Catalyst 2960x-48ts-ll

cisco Catalyst 2960xr-24pd-i

cisco Catalyst 2960xr-24ps-i

cisco Catalyst 2960xr-24td-i

cisco Catalyst 2960xr-24ts-i

cisco Catalyst 2960xr-48fpd-i

cisco Catalyst 2960xr-48fps-i

cisco Catalyst 2960xr-48lpd-i

cisco Catalyst 2960xr-48lps-i

cisco Catalyst 2960xr-48td-i

cisco Catalyst 2960xr-48ts-i

cisco Catalyst 3560c-12pc-s

cisco Catalyst 3560c-8pc-s

cisco Catalyst 3560cg-8pc-s

cisco Catalyst 3560cg-8tc-s

cisco Catalyst 3560cpd-8pt-s

cisco Catalyst 3560x-24p-e

cisco Catalyst 3560x-24p-l

cisco Catalyst 3560x-24p-s

cisco Catalyst 3560x-24t-e

cisco Catalyst 3560x-24t-l

cisco Catalyst 3560x-24t-s

cisco Catalyst 3560x-24u-e

cisco Catalyst 3560x-24u-l

cisco Catalyst 3560x-24u-s

cisco Catalyst 3560x-48p-e

cisco Catalyst 3560x-48p-l

cisco Catalyst 3560x-48p-s

cisco Catalyst 3560x-48pf-e

cisco Catalyst 3560x-48pf-l

cisco Catalyst 3560x-48pf-s

cisco Catalyst 3560x-48t-e

cisco Catalyst 3560x-48t-l

cisco Catalyst 3560x-48t-s

cisco Catalyst 3560x-48u-e

cisco Catalyst 3560x-48u-l

cisco Catalyst 3560x-48u-s

cisco Catalyst 3750x-12s-e

cisco Catalyst 3750x-12s-s

cisco Catalyst 3750x-24p-e

cisco Catalyst 3750x-24p-l

cisco Catalyst 3750x-24p-s

cisco Catalyst 3750x-24s-e

cisco Catalyst 3750x-24s-s

cisco Catalyst 3750x-24t-e

cisco Catalyst 3750x-24t-l

cisco Catalyst 3750x-24t-s

cisco Catalyst 3750x-24u-e

cisco Catalyst 3750x-24u-l

cisco Catalyst 3750x-24u-s

cisco Catalyst 3750x-48p-e

cisco Catalyst 3750x-48p-l

cisco Catalyst 3750x-48p-s

cisco Catalyst 3750x-48pf-e

cisco Catalyst 3750x-48pf-l

cisco Catalyst 3750x-48pf-s

cisco Catalyst 3750x-48t-e

cisco Catalyst 3750x-48t-l

cisco Catalyst 3750x-48t-s

cisco Catalyst 3750x-48u-e

cisco Catalyst 3750x-48u-l

cisco Catalyst 3750x-48u-s

cisco Catalyst 4500 Supervisor Engine 6-e

cisco Catalyst 4500 Supervisor Engine 6l-e

cisco Catalyst 4900m

cisco Catalyst 4948e

cisco Catalyst 4948e-f

cisco Embedded Service 2020 24tc Con

cisco Embedded Service 2020 24tc Con B

cisco Embedded Service 2020 24tc Ncp

cisco Embedded Service 2020 24tc Ncp B

cisco Embedded Service 2020 Con

cisco Embedded Service 2020 Con B

cisco Embedded Service 2020 Ncp

cisco Embedded Service 2020 Ncp B

cisco Ie-3010-16s-8pc

cisco Ie-3010-24tc

cisco Ie 2000-16ptc-g

cisco Ie 2000-16t67

cisco Ie 2000-16t67p

cisco Ie 2000-16tc

cisco Ie 2000-16tc-g

cisco Ie 2000-16tc-g-e

cisco Ie 2000-16tc-g-n

cisco Ie 2000-16tc-g-x

cisco Ie 2000-24t67

cisco Ie 2000-4s-ts-g

cisco Ie 2000-4t

cisco Ie 2000-4t-g

cisco Ie 2000-4ts

cisco Ie 2000-4ts-g

cisco Ie 2000-8t67

cisco Ie 2000-8t67p

cisco Ie 2000-8tc

cisco Ie 2000-8tc-g

cisco Ie 2000-8tc-g-e

cisco Ie 2000-8tc-g-n

cisco Ie 3000-4tc

cisco Ie 3000-8tc

cisco Sm-x Layer 2\/3 Etherswitch Service Module

Event History

Jan 10, 2019

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0282?

The severity of CVE-2018-0282 is classified as high due to its potential for remote exploitation causing device reloads.

How do I fix CVE-2018-0282?

To mitigate CVE-2018-0282, upgrade to the fixed versions of Cisco IOS or IOS XE provided in their security advisory.

What devices are affected by CVE-2018-0282?

CVE-2018-0282 affects a range of Cisco devices running vulnerable versions of Cisco IOS and IOS XE software.

Can CVE-2018-0282 be exploited remotely?

Yes, CVE-2018-0282 can be exploited remotely by an unauthenticated attacker.

What are the potential consequences of CVE-2018-0282?

The potential consequences of CVE-2018-0282 include unauthorized device reloads, leading to service disruptions.

CVE-2018-0282: Cisco IOS and IOS XE Software TCP Denial of Service Vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2018-0282?

How do I fix CVE-2018-0282?

What devices are affected by CVE-2018-0282?

Can CVE-2018-0282 be exploited remotely?

What are the potential consequences of CVE-2018-0282?

Company

Resources

Contact