CVE-2018-0151

CVE-2018-0151 is a critical (CVSS 9.8) buffer overflow (CWE-119) in the quality of service (QoS) subsystem of Cisco IOS and Cisco IOS XE, caused by incorrect bounds checking of values in packets destined to the device itself on UDP port 18999. An unauthenticated, remote attacker triggers the flaw by sending crafted packets to UDP 18999 on an affected device; traffic merely transiting the device will not trigger it. When the malicious packets are processed, an exploitable buffer overflow may allow the attacker to execute arbitrary code with elevated privileges on the device, or alternatively cause the device to reload and create a temporary denial-of-service condition. Any organization running Cisco IOS or IOS XE on routers or switches where UDP 18999 on the device is reachable from an untrusted network is affected. Exploitation is confirmed: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2022-03-03 (ransomware use unknown), and EPSS estimates a 14.2% probability of exploitation in the next 30 days (96th percentile), though no public proof-of-concept is known.

What to do: Apply the fixed Cisco IOS/IOS XE releases specified in the vendor advisory for Bug ID CSCvf73881 as soon as possible, prioritizing internet-facing devices given the KEV listing and critical severity. As an interim mitigation, block or restrict inbound UDP 18999 with interface ACLs or firewall rules so untrusted hosts cannot send packets destined to the device. Inventory your network for Cisco IOS/IOS XE devices and verify which ones accept traffic on UDP 18999 on any externally reachable interface.