CVE-2018-0180

Multiple flaws in the Login Enhancements (Login Block) feature of Cisco IOS Software allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service. The flaw is triggered through crafted login attempts against devices where the Login Block feature is enabled; no authentication or user interaction is required and no information is disclosed. An attacker gains the ability to repeatedly reload the device, disrupting connectivity on the affected box. Any Cisco device running IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later is affected, which in practice means branch and WAN edge routers and similar IOS devices with the Login Block configuration applied. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, indicating known in-the-wild exploitation, and EPSS assigns a 4.9% (92nd percentile) probability of exploitation in the next 30 days; no public proof-of-concept is known.

What to do: Upgrade affected devices to fixed Cisco IOS releases per Cisco's advisory (referencing bug IDs CSCuy32360 and CSCuz60599), as required by CISA's KEV listed action. As an interim mitigation, consider removing the Login Block configuration from VTY lines and restricting remote login access to trusted management hosts with ACLs. Inventory devices running IOS 15.4(2)T, 15.4(3)M, or 15.4(2)CG or later and prioritize those exposed to untrusted networks.