HackZoneLabs News
Newsletter

CVE-2018-0161

Cisco IOS Software Resource Management Errors Vulnerability

  • Medium 6.3
  • Exploited: added to CISA KEV 3 Mar 2022

Description

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability is due to a condition that could occur when the affected software processes an SNMP read request that contains a request for the ciscoFlashMIB object ID (OID). An attacker could trigger this vulnerability by issuing an SNMP GET request for the ciscoFlashMIB OID on an affected device. A successful exploit could cause the affected device to restart due to a SYS-3-CPUHOG. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS Software and are configured to use SNMP Version 2 (SNMPv2) or SNMP Version 3 (SNMPv3): Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P, Cisco Catalyst Digital Building Series Switches 8U. Cisco Bug IDs: CSCvd89541.

Key facts

Published
28 Mar 2018
Last changed
12 Jan 2026
Assigned by
cisco
KEV added
3 Mar 2022
KEV fix due
17 Mar 2022
EPSS
4.116% likely to be exploited in the next 30 days, higher than 90.946% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: no; Technical impact: partial

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 6.3CVSS 3.1, Mediumfrom CISA (ADP container)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

What to do

  • Apply updates per vendor instructions.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
n/aCisco IOS
  • Cisco IOS (affected)

Timeline

  1. 28 Mar 2018 Published
  2. 3 Mar 2022 Added to the CISA KEV catalogue

Weakness

References