Intel

CVE-2018-0151

Cisco IOS and IOS XE Software — Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability

criticalKEV: actively exploitedPoCEPSS 14%

Description

A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 18999 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code on the affected device with elevated privileges. The attacker could also leverage this vulnerability to cause the device to reload, causing a temporary DoS condition while the device is reloading. The malicious packets must be destined to and processed by an affected device. Traffic transiting a device will not trigger the vulnerability. Cisco Bug IDs: CSCvf73881.

Source: CISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2018-0151 scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — an unauthenticated remote attacker can achieve arbitrary code execution with elevated privileges on network infrastructure with no preconditions whatsoever. The EPSS score of 14.2 % places this vulnerability in the 96th percentile, indicating a statistically high likelihood of active exploitation attempts in the wild. For NIS2-scoped organisations, core routing infrastructure is typically classified as a critical asset: a compromised router enables full traffic interception, network-wide lateral movement, and potential pivot into OT or ICS segments. Although CISA has not flagged known ransomware campaign use, the combination of unauthenticated RCE and availability impact (reload-based DoS) makes this a top-tier priority for any organisation running Cisco IOS or IOS XE in its critical path. Patch immediately; do not defer to the next scheduled maintenance window.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Cisco has released fixes for CVE-2018-0151 (Bug ID CSCvf73881) for affected IOS and IOS XE releases. Identify the correct fixed release for your train via the Cisco PSIRT advisory (cisco.com/go/psirt) and schedule emergency maintenance immediately.
  • Block UDP port 18999 at the perimeter: Apply ACLs or firewall rules to drop all inbound traffic destined for UDP/18999 on Cisco router and switch management IPs. This port serves the QoS subsystem exclusively and should never be reachable from untrusted networks.
  • Enumerate affected devices: Run show version across your Cisco IOS/IOS XE estate and cross-reference output against the Cisco advisory's affected-version table. Devices that cannot be patched immediately must be treated as high-risk and monitored intensively.
  • Harden management-plane access: Confirm that management interfaces are reachable only from a dedicated out-of-band management VLAN via jump hosts. Remove any direct internet exposure of device management interfaces.
  • Enable enhanced logging: Activate logging buffered debugging and NetFlow/IPFIX collection for UDP/18999 on affected devices to support retrospective forensic analysis of any exploitation attempts.

Runbook · Step 2

Mitigation layers

  • Device-level iACL: Deploy an Infrastructure Access Control List directly on each Cisco device to drop UDP/18999 from all sources except explicitly authorised management hosts: 
    deny udp any any eq 18999
    Apply this ACL inbound on all interfaces not belonging to the management segment.
  • Network segmentation: Move routing infrastructure into a dedicated management VLAN aligned with RFC 2827 / BCP 38 principles. Restrict lateral movement paths to network devices through micro-segmentation.
  • IPS/IDS signature: Configure Suricata or a Cisco IPS with a rule targeting anomalous UDP payloads on port 18999 (the bounds-checking flaw produces oversized packets): 
    alert udp any any -> $ROUTER_NET 18999 (msg:"CVE-2018-0151 QoS exploit attempt"; dsize:>512; sid:2018015101; rev:1;)
  • AAA and credential hygiene: Verify that TACACS+/RADIUS-based AAA is enforced and that no local fallback accounts with weak credentials exist. A successful RCE delivers elevated privileges on the device, making pre-existing credential hygiene a critical compensating control.
  • Reduce attack surface: Disable the QoS subsystem (no ip qos) on devices where it is not operationally required, and disable any other unused IOS/IOS XE services to minimise exposure.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): Alert on any UDP flow to port 18999 targeting router or switch IP addresses. Any external host sending UDP/18999 to infrastructure IPs is an immediate high-priority alert: 
    alert udp $EXTERNAL_NET any -> $ROUTER_NET 18999
  • NetFlow/IPFIX in SIEM (Splunk SPL): 
    index=netflow dest_port=18999 proto=UDP | stats count by src_ip dest_ip | where count > 0
  • Cisco syslog correlation: Hunt for %SYS-2-MALLOCFAIL, %SYS-3-CPUHOG, or %SYS-6-RELOAD messages on Cisco devices that are preceded within 60 seconds by UDP/18999 traffic — this pattern is consistent with a buffer overflow triggering a device reload.
  • SNMP trap monitoring: Correlate SNMP coldStart or warmStart traps from Cisco devices with network logs showing UDP/18999 traffic in the preceding minute. Unexpected reboots on core routers warrant immediate incident declaration.
  • Configuration change detection: Post-exploitation persistence may manifest as unauthorised configuration changes. Monitor RANCID, Oxidized, or Cisco DNA Center for unexpected config diffs; enable archive log config on IOS/IOS XE devices if not already active.

Metrics

Severity
critical
Priority score
207.71
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
96.4 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
14.2 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2022-03-03 00:00 UTC
CWE
CWE-119

Weakness classes (CWE)

  • CWE-119Class

    Improper Restriction of Operations within the Bounds of a Memory Buffer

    The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

    cwe.mitre.org →

Affected operating systems

  • mobile

    cisco / ios_xe16.5.1

  • mobile

    cisco / ios_xe

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2018-0151