---
id: "CVE-2018-0159"
kind: "vulnerability"
aliases: ["CVE-2018-0159"]
title: "Cisco IOS Software and Cisco IOS XE Software: Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.0687
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco IOS Software and Cisco IOS XE Software", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "exploited", "infrastructure", "ios", "ios-xe", "ipsec", "vpn"]
not_affected_if: ["no-ikev1-enabled"]
published_at: "2018-03-28T22:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0159", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-0159", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0159", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Cisco IOS Software and Cisco IOS XE Software: Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability

A flaw in how Cisco IOS and IOS XE handle IKEv1 (Internet Key Exchange version 1) lets a remote attacker crash the device with crafted traffic. The attacker gets a denial of service: the router or switch reloads, but no code execution or data access is stated in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco IOS Software and Cisco IOS XE Software affected ? fixed ?

## Fix

Apply the Cisco IOS/IOS XE update per vendor instructions (CISA KEV required action); the fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0159
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-0159
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-0159

## From the sources

A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_