CVE-2018-0154

A vulnerability in the crypto engine of Cisco's Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software allows an unauthenticated, remote attacker to hang or crash the affected router, causing a denial of service. The flaw (CWE-399, resource management) is caused by insufficient handling of VPN traffic and is triggered by sending crafted VPN traffic directly to an affected device, requiring no authentication, credentials, or user interaction. A successful exploit yields only availability impact — the device hangs or crashes — with no confidentiality or integrity impact per the CVSS 3.1 vector. Any organization running Cisco IOS on a device equipped with an ISM-VPN accelerator module and reachable for VPN traffic is affected. The flaw is being exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03 — and EPSS assigns a 7.1% (94th percentile) probability of exploitation in the next 30 days, though no public proof-of-concept is known and ransomware use is unknown.

What to do: Apply the fixed IOS releases identified in Cisco's advisory for Bug ID CSCvd39267 per vendor instructions. Inventory devices with 'show inventory' or similar to confirm whether an ISM-VPN module (ISM-VPN-100/300/800 class) is installed, and restrict IKE/ESP (VPN) traffic to trusted peers with ACLs or firewall rules as an interim mitigation. Prioritize patching internet-reachable routers acting as VPN endpoints, given the KEV listing and high EPSS score.