CVE-2018-0161

CVE-2018-0161 is a resource-management flaw (CWE-399) in the Simple Network Management Protocol subsystem of Cisco IOS on certain Catalyst switch models. An authenticated, remote attacker triggers it by sending an SNMPv2c or SNMPv3 GET request for the ciscoFlashMib object ID (OID) to an affected device; processing this request can produce a SYS-3-CPUHOG condition and force the switch to restart. The impact is denial of service on the switch only, with no confidentiality or integrity loss. Only Cisco Catalyst 2960-L Series, Catalyst Digital Building Series 8P, and Catalyst Digital Building Series 8U switches running a vulnerable IOS release with SNMPv2c or SNMPv3 configured are affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, confirming in-the-wild exploitation; ransomware use is unknown, EPSS is moderate at ~4.1% (90th percentile), and no public PoC is known.

What to do: Upgrade Cisco IOS on the affected Catalyst 2960-L and Digital Building switches to a fixed release per Cisco's advisory for bug CSCvd89541; this is a required action under the CISA KEV catalog. As interim mitigation, restrict SNMP (UDP 161) to trusted management hosts with ACLs or disable SNMPv2c/v3 where unused, and rotate/default-check community strings since exploitation requires valid SNMP credentials. Hunt for compromise indicators by checking switch logs for SYS-3-CPUHOG-forced reloads that coincide with SNMP GET requests for the ciscoFlashMIB OID.