« Volver al listado

CVE-2018-0241

Estado: ModificadaAlta (7.4)—

A vulnerability in the UDP broadcast forwarding function of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to improper handling of UDP broadcast packets that are forwarded to an IPv4 helper address. An attacker could exploit this vulnerability by sending multiple UDP broadcast packets to the affected device. An exploit could allow the attacker to cause a buffer leak on the affected device, eventually resulting in a DoS condition requiring manual intervention to recover.

Leer descripción completaMostrar menos

This vulnerability affects all Cisco IOS XR platforms running 6.3.1, 6.2.3, or earlier releases of Cisco IOS XR Software when at least one IPv4 helper address is configured on an interface of the device. Cisco Bug IDs: CSCvi35625.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — IOS XR

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-0241",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2018-0241",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-29T14:38:36.573899Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.1,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 7.4,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Cisco IOS XR",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco IOS XR"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-04-19T20:29:00.877",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/103929",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1040710",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-iosxr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/103929",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1040710",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-iosxr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the UDP broadcast forwarding function of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to improper handling of UDP broadcast packets that are forwarded to an IPv4 helper address. An attacker could exploit this vulnerability by sending multiple UDP broadcast packets to the affected device. An exploit could allow the attacker to cause a buffer leak on the affected device, eventually resulting in a DoS condition requiring manual intervention to recover. This vulnerability affects all Cisco IOS XR platforms running 6.3.1, 6.2.3, or earlier releases of Cisco IOS XR Software when at least one IPv4 helper address is configured on an interface of the device. Cisco Bug IDs: CSCvi35625."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la función de reenvío de transmisiones UDP en Cisco IOS XR Software podría permitir que un atacante remoto sin autenticar provoque una denegación de servicio (DoS) en un sistema afectado. La vulnerabilidad se debe a la gestión incorrecta de los paquetes de transmisión UDP que se reenvían a una dirección auxiliar IPv4. Un atacante podría explotar esta vulnerabilidad enviando múltiples paquetes de transmisión UDP a un dispositivo afectado. Un exploit podría permitir que el atacante provoque una fuga del búfer en el dispositivo afectado, lo que resultaría finalmente en una denegación de servicio (DoS) que requeriría una intervención manual para recuperarla. La vulnerabilidad afecta a todas las plataformas Cisco IOS XR que ejecuten las versiones 6.3.1, 6.2.3 o anteriores de Cisco IOS XR Software cuando, al menos, una dirección IPv4 auxiliar está configurada en una interfaz del dispositivo. Cisco Bug IDs: CSCvi35625."
    }
  ],
  "lastModified": "2026-06-17T01:30:18.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:4.0.4.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "527A8627-BB02-420C-8455-88E513FE1E5B"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:4.1.3.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47A44BA1-9644-4828-A237-50F9828A5BE9"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:4.2.4.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "426C901C-0C18-4DA6-8A9E-C7530CABCF2F"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:4.3.4.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0B3BB42-4CC3-4463-985E-7728C2F1CE2D"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:4.4.3.ce:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00C20AD9-19A8-42AB-B46D-7A74FF3502B0"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:5.0.3.ce:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F450B67-0C12-42AC-BAB9-5CB680F6C3F9"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:5.1.4.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A59E9CE1-88BE-4BEC-A578-8B5C41560EE6"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:5.2.5.ce:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "037143C6-8C0E-4EAD-B4D9-1DEECF67D7A5"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:5.3.4.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BDA4B2C-7770-4689-8C1C-8645AD6C8916"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:5.4.3.ce:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36A18333-0858-41AE-B856-AAE4D8C97F23"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:6.0.4.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED7EBC2F-31AF-4353-976F-E82FCDB89E98"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:6.1.4.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FE2DAAB-D5EB-4D14-916A-732F4CDF4226"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xr:6.2.3.base:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6EEDE502-5A17-4C30-970C-F3867A148C77"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "324C97E6-1810-404F-9F45-6240F99FF039"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "57EB55BB-41B7-40A1-B6F5-142FE8AB4C16"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "433F4A82-04A4-4EAA-8C19-F7581DCD8D29"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A93212A4-50AB-42E7-89A4-5FBBAEA050C3"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EDA53A61-98B3-458C-8893-61CD7D6B1E48"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F396564E-B477-4A27-A189-CEB737552E25"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5445CC54-ACFB-4070-AF26-F91FEAA85181"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D7AA58E5-D7E1-48CF-93FF-C60EB85B2BC7"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}