CVE-2018-0241 / Cisco CISCO-SA-20180418-IOSXR: n/a Cisco IOS XR: security vulnerability

Recommended actionWithin 7 days

High technical severity; prioritise exposed affected systems while verifying vendor guidance.

Fix not verified

What, why and how

A vulnerability in the UDP broadcast forwarding function of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to improper handling of UDP broadcast packets that are forwarded to an IPv4 helper address. An attacker could exploit this vulnerability by sending multiple UDP broadcast packets to the affected device. An exploit could allow the attacker to cause a buffer leak on the affected device, eventually resulting in a DoS condition requiring manual intervention to recover. This vulnerability affects all Cisco IOS XR platforms running 6.3.1, 6.2.3, or earlier releases of Cisco IOS XR Software when at least one IPv4 helper address is configured on an interface of the device. Cisco Bug IDs: CSCvi35625.

What

Why

The current structured CVE record identifies a security weakness, but the root cause requires confirmation in the linked vendor material.

How

An attacker operating through the affected interface may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.

What

Why

The current structured CVE record identifies a security weakness, but the root cause requires confirmation in the linked vendor material.

How

An attacker operating through the affected interface may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: the affected interface → vulnerable operation → disrupt the affected service
Attack surface: Unspecified
Privileges required: None: unauthenticated exploitation is possible
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Changed: exploitation can affect a different security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-399 ↗
CWE-399. Open the MITRE definition for the exact weakness description.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Common Vulnerability Scoring System 3.0: the compact vector below is decoded into plain language.
AVAdjacentAttack vector: The attacker must be on an adjacent or logically close network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SChangedScope: The attack can affect a component governed by a different security authority.CNoneConfidentiality impact: No direct loss is represented by this metric.INoneIntegrity impact: No direct loss is represented by this metric.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.

UnauthenticatedDenial of serviceCWE-399

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2018-1064Official EUVD mapping

0 linked advisory records.

Official EUVD record ↗

Canadian Centre for Cyber Security · English · AV18-067Cisco security updates

Origin Resource Sharing Vulnerability Cisco cBR Series Converged Broadband Routers High CPU Usage Denial of Service Vulnerability Cisco Adaptive Security Appliance Clientless SSL VPN Cross-Site Scripting Vulnerability Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability Cisco AMP for Endpoints macOS Connector DMG File Malware Bypass Vulnerability Cisco MATE Live Directory Information Disclosure Vulnerability Cisco MATE Collector Cross-Site Request Forgery Vulnerability Cisco Wireless LAN Controller Default Simple Network Management Protocol Community Strings CVE References: CVE-2018-0112, CVE-2018-0238, CVE-2018-0239, CVE-2018-0241 , CVE-2018-0233, CVE-2018-0230, CVE-2018-0229, CVE-2018-0240, CVE-2018-0231, CVE-2018-0228, CVE-2018-0227, CVE-2018-0276, CVE-2018-0267, CVE-2018-0267, CVE-2018-0266, CVE-2018-0273, CVE-2018-0256, CVE-2018-0275, CVE-2018-0255, CVE-2018-0254, CVE-2018-0244, CVE-2018-0243, CVE-2018-0272, CVE-2018-0269, CVE-2018-0257, CVE-2018-0251, CVE-2018-0242, CVE-2018-0237, CVE-2018-0260, CVE-2018-0259 Suggested Action CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly. References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-wbs https://too

Official advisory ↗

CERT-FR · French · CERTFR-2018-AVI-194Multiples vulnérabilités dans les produits Cisco

De multiples vulnérabilités ont été découvertes dans les produits Cisco . Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Official advisory ↗

JVN iPedia · Japanese · JVNDB-2018-004426Cisco IOS XR ソフトウェアにおけるリソース管理に関する脆弱性

Cisco IOS XR ソフトウェアには、リソース管理に関する脆弱性が存在します。ベンダは、本脆弱性を Bug ID CSCvi35625 として公開しています。

Official advisory ↗

KISA KrCERT/CC · Korean · KNVD-4858Cisco 제품군 취약점 보안 업데이트 권고

격자는 해당 취약점을 이용하여 피해를 발생시킬 수 있어 해당 Cisco 제품을 사용하는 이용자들은 최신 버전으로 업데이트할 것을 권고 ##### □ 주요 내용 o Cisco WebEx Client에서 발생하는 원격 코드 실행 취약점(CVE-2018-0112) [1] o Cisco Adaptive Security Appliance(ASA)의 수신 흐름을 지정하는 기능에서 발생하는 서비스 거부 취약점(CVE-2018-0228) [2] o Cisco ASA Software, FTD Software, AnyConnect Secure Mobility Client의 Single Sign-On 인증을 위한 SAML(Security Assertion Markup Language)에서 발생하는 세션 관리 미흡 취약점(CVE-2018-0229) [3] o Cisco Unified Computing System(UCS)의 Director End-User 포털에서 발생하는 가상 머신 정보 유출 취약점 (CVE-2018-0238) [4] o Cisco StarOS의 패킷 처리 과정에서 발생하는 서비스 거부 취약점(CVE-2018-0239) [5] o Cisco IOS XR Software에서 UDP 브로드캐스트를 포워딩하는 기능으로 인해 발생하는 서비스 거부 취약점 (CVE-2018-0241) [6] o Cisco Firepower System 소프트웨어의 Detection Engine에서 SSL 패킷을 처리하는 과정에서 발생하는 서비스 거부 취약점(CVE-2018-0233) [7] o Cisco Adaptive Security Appliance(ASA) 소프트웨어의 Application Layer 프로토콜에서 발생하는 서비스 거부 취약점(CVE-2018-0240) [8] o Cisco Firepower 2100 시리즈에서 사용하는 Firepower Threat Defense(FTD) 소프트웨어의 내부 패킷을 처리하는 과정에서 발생하는 서비스 거부 취약점(CVE-2018-0230) [9] o Cisco Adaptive Security Appliance(ASA) 소프트웨어 및 Firepower Threat Defense(FTD) 소프트웨어의 TLS 라이브러리에서 발생하는 서비스 거부 취약점(CVE-2018-0231) [10] o Cisco Adaptive Security Appliance(ASA)의 가상사설망(VPN) SSL 클라이언트 인증 우회 취약점(CVE-2018-0227) [11] ##### □ 영향을 받는 시스템 o 참고사이트에 명시되어 있는 ‘Affected Products’을 통해 취약한 제품 확인 ##### □ 해결 방

Official advisory ↗

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Fix not verified
Affected: Cisco IOS XR: Cisco IOS XR
Fixed: No fixed version is explicitly recorded in the structured CVE data.
Action: No verified patch reference is present in the current structured sources. Check the vendor advisory before making a change.
Workaround: No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.

Evidence and provenance

Published 19 Apr 2018 · Last source change 29 Nov 2024, 15:16 UTC · CWE-399

CVE recordCVE.org · 5.1

CVSS sourceNIST NVD

EPSS source

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-09-01

European sourceENISA EUVD · EUVD-2018-1064

Product sourceCNA

Remediation sourceCVE/CNA references

CWE sourceCNA

NVD statusNVD modified after enrichment

Missing structured fields: affected product. Missing data is not evidence of low risk; review the primary advisory.

Material change intelligence

What changed after publication

View recent updates ↗

1 Sep 2026, 02:42 UTC
ENISA EUVD mappingEUVD-2018-1064 was added to the official ENISA EUVD mapping for this CVE.
Before
not recorded
After
{"euvdId":"EUVD-2018-1064"}
ENISA EUVD ↗
29 Nov 2024, 15:16 UTC
Vendor guidanceAuthoritative vendor guidance changed: added vendor advisory: tools.cisco.com/cisco-sa-20180418-iosxr.
Before
no authoritative guidance recorded
After
vendor advisory: tools.cisco.com/cisco-sa-20180418-iosxr
tools.cisco.com ↗
29 Nov 2024, 15:16 UTC
SeveritySeverity changed from Unknown to High.
Before
Unknown
After
High
NIST NVD ↗
29 Nov 2024, 15:16 UTC
CVSS scoreCVSS score changed from not recorded to 7.4 (CVSS 3.0 · NIST NVD · CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
Before
not recorded
After
7.4 (CVSS 3.0 · NIST NVD · CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
NIST NVD ↗
29 Nov 2024, 15:16 UTC
Catalogue recordCVE added to the BlackTree catalogue.
CNA ↗

2018-04-19CVE published

ENISA EUVD · EUVD-2018-1064↗CVE authority or vendor reference · Cisco CISCO-SA-20180418-IOSXR↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.

n/a Cisco IOS XR: security vulnerability

Published severity in operational context

Evidence used

Compensating controls

Verification

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

ENISA European Vulnerability Database

EUVD-2018-1064

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

What changed after publication