{"id":"CVE-2018-0161","kind":"vulnerability","aliases":["CVE-2018-0161"],"related":[],"title":"Cisco IOS Software: Cisco IOS Software Resource Management Errors Vulnerability","description":"A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability is due to a condition that could occur when the affected software processes an SNMP read request that contains a request for the ciscoFlashMIB object ID (OID). An attacker could trigger this vulnerability by issuing an SNMP GET request for the ciscoFlashMIB OID on an affected device. A successful exploit could cause the affected device to restart due to a SYS-3-CPUHOG. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS Software and are configured to use SNMP Version 2 (SNMPv2) or SNMP Version 3 (SNMPv3): Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P, Cisco Catalyst Digital Building Series Switches 8U. Cisco Bug IDs: CSCvd89541.","summary":"A flaw in the SNMP subsystem of Cisco IOS Software on certain Catalyst switches lets an authenticated remote attacker cause a denial of service. The sources say it is in CISA's known-exploited list, but they do not describe the exploit.","severity":"medium","cvss":6.3,"epss":0.04116,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Cisco IOS Software","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["catalyst","cisco","exploited","infrastructure","ios","snmp"],"not_affected_if":["non-catalyst-models","snmp-disabled"],"how_to_check":null,"fix":"Apply the updates per vendor instructions (CISA required action). The fixed version is unknown from the sources.","status":"open","published_at":"2018-03-28T22:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:09+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:26:09Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per vendor instructions (CISA required action). The fixed version is unknown from the sources.","reach":"network","impact":"low","summary":"A flaw in the SNMP subsystem of Cisco IOS Software on certain Catalyst switches lets an authenticated remote attacker cause a denial of service. The sources say it is in CISA's known-exploited list, but they do not describe the exploit.","category":"infrastructure","who_cares":["cisco","catalyst","ios","snmp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker crashes switch via SNMP, causing denial of service","analyst_note":"Confirm affected Catalyst models and fixed IOS versions from the Cisco advisory linked from the KEV entry, and how_to_check (SNMP config and version output).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["snmp-disabled","non-catalyst-models"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000475,"input_tokens":2870,"output_tokens":375,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0161':13A,16A '-2018':12A,15A '-3':178C '2':205C '2960':214C '3':210C '8p':224C '8u':231C 'affect':127C,162C,170C,182C 'aka':105C 'allow':92C 'attack':44B,96C,145C 'authent':42B,94C 'bug':233C 'build':221C,228C 'catalyst':20B,38B,89C,213C,219C,226C 'caus':45B,98C,168C 'certain':37B,85C 'cisa':56B 'cisco':1A,4A,17A,21B,33B,80C,88C,185C,195C,212C,218C,225C,232C 'ciscoflashmib':140C,158C 'condit':104C,121C 'configur':200C 'contain':135C 'could':91C,123C,146C,167C 'cpuhog':179C 'cscvd89541':235C 'cve':11A,14A 'denial':47B,100C,111C 'describ':66B 'devic':163C,171C,186C 'digit':220C,227C 'dos':103C 'due':118C,174C 'error':9A 'exploit':22B,60B,68B,166C 'flaw':27B 'follow':184C 'get':107C,154C 'id':110C,142C,234C 'infrastructur':23B 'io':2A,5A,24B,34B,81C,196C 'ios':18A 'issu':151C 'known':59B 'known-exploit':58B 'l':215C 'let':40B 'list':61B 'manag':8A,75C 'mib':108C 'model':86C 'network':74C 'object':109C,141C 'occur':124C 'oid':143C,159C 'process':129C 'protocol':76C 'read':132C 'releas':193C 'remot':43B,95C 'request':133C,137C,155C 'resourc':7A 'restart':173C 'run':83C,190C 'say':52B 'seri':216C,222C,229C 'servic':49B,102C,113C 'simpl':73C 'snmp':25B,30B,77C,131C,153C,203C,208C 'snmpv2':206C 'snmpv3':211C 'softwar':3A,6A,35B,82C,128C,197C 'software':19A 'sourc':51B 'subsystem':31B,78C 'success':165C 'switch':39B,90C,217C,223C,230C 'sys':177C 'trigger':147C 'use':202C 'version':204C,209C 'vulner':10A,70C,114C,116C,149C,181C,192C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-03-28T22:29:00+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-0161","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0161","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2018-0161","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0161","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-0161","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0161","severity":null,"published_at":"2018-03-28T22:29:00+00:00","modified_at":"2026-06-17T01:29:58+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}