{"id":"CVE-2018-0159","kind":"vulnerability","aliases":["CVE-2018-0159"],"related":[],"title":"Cisco IOS Software and Cisco IOS XE Software: Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability","description":"A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.","summary":"A flaw in how Cisco IOS and IOS XE handle IKEv1 (Internet Key Exchange version 1) lets a remote attacker crash the device with crafted traffic. The attacker gets a denial of service: the router or switch reloads, but no code execution or data access is stated in the sources.","severity":"high","cvss":7.8,"epss":0.0687,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Cisco IOS Software and Cisco IOS XE Software","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","infrastructure","ios","ios-xe","ipsec","vpn"],"not_affected_if":["no-ikev1-enabled"],"how_to_check":null,"fix":"Apply the Cisco IOS/IOS XE update per vendor instructions (CISA KEV required action); the fixed version is unknown from the sources.","status":"open","published_at":"2018-03-28T22:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:21+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:26:21Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco IOS/IOS XE update per vendor instructions (CISA KEV required action); the fixed version is unknown from the sources.\nUnknown which exact releases are fixed.","reach":"network","impact":"low","summary":"A flaw in how Cisco IOS and IOS XE handle IKEv1 (Internet Key Exchange version 1) lets a remote attacker crash the device with crafted traffic. The attacker gets a denial of service: the router or switch reloads, but no code execution or data access is stated in the sources.","category":"infrastructure","who_cares":["cisco","ios","ios-xe","vpn","ipsec"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote unauthenticated attacker reloads the affected Cisco device, causing denial of service.","analyst_note":"Confirm affected and fixed IOS/IOS XE versions and the IKEv1 exposure check from the Cisco security advisory for CVE-2018-0159 (cisco.com/c/en/us/support/docs/csa).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ikev1-enabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000514,"input_tokens":2926,"output_tokens":443,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0159':26A,29A '-2018':25A,28A '1':18A,62B,107C 'access':91B 'affect':128C,164C,180C 'allow':120C,174C 'and':33A 'attack':66B,74B,124C,152C,176C 'bug':190C 'caus':126C,178C 'cisco':1A,5A,9A,30A,34A,38B,51B,111C,115C,189C 'code':87B 'condit':139C,188C 'could':119C,153C,173C 'craft':71B,159C 'crash':67B 'cscuj73916':192C 'cve':24A,27A 'data':90B 'denial':20A,77B,135C 'denial-of-servic':19A 'devic':69B,129C,165C,181C 'dos':138C,187C 'due':143C 'exchang':16A,60B,105C 'execut':88B 'exploit':39B,154C,172C 'flaw':48B 'function':109C 'get':75B 'handl':56B 'id':191C 'ike':168C 'ikev1':57B,108C,149C,160C 'implement':101C 'improp':145C 'infrastructur':40B 'internet':14A,58B,103C 'io':2A,6A,10A,41B,43B,52B,54B,112C,116C 'ios':31A,35A 'ios-x':42B 'ipsec':45B 'key':15A,59B,104C 'let':63B 'negoti':169C 'packet':150C,161C 'reload':84B,131C,183C 'remot':65B,123C 'result':132C,184C 'router':81B 'send':158C 'servic':22A,79B,137C 'softwar':3A,8A,13A,113C,118C 'software':32A,37A 'sourc':96B 'specif':148C 'state':93B 'success':171C 'switch':83B 'traffic':72B 'unauthent':122C 'valid':146C 'version':17A,61B,106C 'vpn':46B 'vulner':23A,98C,141C,156C 'xe':7A,12A,36A,44B,55B,117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-03-28T22:29:00+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-0159","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0159","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:58+00:00","note":null},{"source":"epss","external_id":"CVE-2018-0159","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0159","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-0159","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0159","severity":null,"published_at":"2018-03-28T22:29:00+00:00","modified_at":"2026-06-17T01:29:58+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}