vulnwire
8.6high

CVE-2018-0132

A vulnerability in the forwarding information base (FIB) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to c…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
8.6
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.3%
percentile 83%
Public exploits
0
none known

A vulnerability in the forwarding information base (FIB) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause inconsistency between the routing information base (RIB) and the FIB, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect processing of extremely long routing updates. An attacker could exploit this vulnerability by sending a large routing update. A successful exploit could allow the attacker to trigger inconsistency between the FIB and the RIB, resulting in a DoS condition. Cisco Bug IDs: CSCus84718.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
23 mo ago

Exploit prediction (EPSS)

2.30% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • n/a Cisco IOS XR

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • securityfocus.com /bid/102975 · vdb-entry, x_refsource_BID, x_transferred
  • tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-iosxr · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1040344 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.