CVE-2018-0485

moderate-risk
Published 2018-10-05

A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers (ISR G2) and the Cisco 4451-X Integrated Services Router (ISR4451-X) could allow an unauthenticated, remote attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of user input. An attacker could exploit this vulnerability by first connecting to the SM-1T3/E3 module console and entering a string sequence. A successful exploit could allow the attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resulting in a DoS condition on an affected device.

Do I need to act?

~
3.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.6/10 High
NETWORK / LOW complexity

Affected Products (2)

Ios

Affected Vendors

Cisco

References (8)

Third Party Advisory http://www.securityfocus.com/bid/105433
Third Party Advisory http://www.securitytracker.com/id/1041736
Third Party Advisory http://www.securitytracker.com/id/1041737
Vendor Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2...
Third Party Advisory http://www.securityfocus.com/bid/105433
Third Party Advisory http://www.securitytracker.com/id/1041736
Third Party Advisory http://www.securitytracker.com/id/1041737
Vendor Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2...
43
/ 100
moderate-risk
Severity 29/34 · Critical
Exploitability 7/34 · Low
Exposure 7/34 · Low