CVE-2018-0346: Buffer Overflow
First published: Wed Jul 18 2018(Updated: )
A vulnerability in the Zero Touch Provisioning service of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect bounds checks for certain values in packets that are sent to the Zero Touch Provisioning service of the affected software. An attacker could exploit this vulnerability by sending malicious packets to the affected software for processing. When the software processes the packets, a buffer overflow condition could occur and cause an affected device to reload. A successful exploit could allow the attacker to cause a temporary DoS condition while the device reloads. This vulnerability can be exploited only by traffic that is destined for an affected device. It cannot be exploited by traffic that is transiting a device. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69914.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco vBond Orchestrator | ||
| Cisco vEdge | ||
| Cisco vEdge | ||
| Cisco vManage Network Management | ||
| Cisco SD-WAN vSmart Controller | ||
| Cisco vEdge 100WM Firmware | <18.3.0 | |
| Cisco vEdge 100b Router | ||
| Pepperl-fuchs Pcv100-f200-b17-v1d Firmware | <18.3.0 | |
| Cisco vEdge 100b Router | ||
| Cisco vEdge 100M Firmware | <18.3.0 | |
| Cisco vEdge 100m router | ||
| Cisco vEdge 100WM Firmware | <18.3.0 | |
| Cisco vEdge 100wm router | ||
| Cisco vEdge-1000 Firmware | <18.3.0 | |
| Cisco vEdge-1000 Firmware | ||
| Cisco vEdge 2000 Firmware | <18.3.0 | |
| Cisco vEdge 2000 | ||
| Cisco vEdge-5000 firmware | <18.3.0 | |
| Cisco vEdge 5000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-0346.
What is the severity of CVE-2018-0346?
The severity of CVE-2018-0346 is high with a severity value of 7.5.
What is the affected software for CVE-2018-0346?
The affected software for CVE-2018-0346 includes Cisco Vbond Orchestrator, Cisco Vedge-plus, Cisco Vedge-pro, Cisco Vmanage Network Management, and Cisco Vsmart Controller.
How does CVE-2018-0346 impact the affected devices?
CVE-2018-0346 can allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected devices.
Are there any known fixes for CVE-2018-0346?
Please refer to the official Cisco Security Advisory for available fixes and mitigations for CVE-2018-0346.
- agent/references
- agent/type
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco vbond orchestrator
- canonical/cisco vedge
- canonical/cisco vmanage network management
- canonical/cisco sd-wan vsmart controller
- canonical/cisco vedge 100wm firmware
- canonical/cisco vedge 100b router
- canonical/pepperl-fuchs pcv100-f200-b17-v1d firmware
- canonical/cisco vedge 100m firmware
- canonical/cisco vedge 100m router
- canonical/cisco vedge 100wm router
- canonical/cisco vedge-1000 firmware
- canonical/cisco vedge 2000 firmware
- canonical/cisco vedge 2000
- canonical/cisco vedge-5000 firmware
- canonical/cisco vedge 5000