CVE-2018-0159

CVE-2018-0159 is an improper input validation flaw (CWE-20) in the Internet Key Exchange Version 1 (IKEv1) implementation of Cisco IOS and Cisco IOS XE software. An unauthenticated, remote attacker can trigger it by sending crafted IKEv1 packets to an affected device during an IKE negotiation, typically against a device listening for IKE on UDP 500/4500 such as an IPsec VPN gateway. A successful attack forces the device to reload, causing a denial of service; there is no confidentiality or integrity impact, consistent with the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/A:H). Any organization running Cisco IOS or IOS XE on routers, switches, or VPN endpoints with IKEv1 enabled is potentially affected, with exposure concentrated on internet-reachable VPN concentrators. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, and EPSS estimates a 6.9% chance of exploitation within 30 days (94th percentile), though no public proof-of-concept is known.

What to do: Apply fixed Cisco IOS/IOS XE software per Cisco's advisory and the CISA KEV required action, prioritizing internet-facing VPN gateways and concentrators. Inventory devices for IKEv1 use (crypto ISAKMP configuration, IKE listeners on UDP 500/4500) and, where patching is delayed, restrict IKE traffic to trusted peer addresses using infrastructure ACLs or disable IKEv1 if only IKEv2 is required.