AEGLIX vulnerability intelligence
CVE-2018-0155
HIGH · CVSS 8.6 · Analyzed
Published: 2018-03-28 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.
Severity and scoring
- CVSS score
- 8.6 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Weaknesses
- CWE-388, CWE-755
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Cisco · Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches
- Added to catalog
- 2022-03-03
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-03-17
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:o:cisco:ios:3.6\(2\)e:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:3.6\(2\)e:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:3.6\(2\)e:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:3.6\(2\)e:*:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://www.securityfocus.com/bid/103565
Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id/1040587
Third Party Advisory · VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05
Third Party Advisory · US Government Resource
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-bfd
Vendor Advisory
- http://www.securityfocus.com/bid/103565
Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id/1040587
Third Party Advisory · VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05
Third Party Advisory · US Government Resource
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-bfd
Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0155
US Government Resource