{"schemaVersion":3,"id":"CVE-2018-0154","aliases":[],"status":"published","duplicateOf":null,"title":"Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability","description":"A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to hang or crash, resulting in a DoS condition. Cisco Bug IDs: CSCvd39267.","dates":{"published":"2018-03-28T22:00:00.000Z","modified":"2026-01-12T21:51:50.881Z","reserved":null,"kevAdded":["2022-03-03T00:00:00.000Z"],"kevDue":["2022-03-17T00:00:00.000Z"]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.8,"severity":"high","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0707,"percentile":0.94143,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.0707},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0707,"percentile":0.94143}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0707,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0707,"percentile":0.94143}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-03T00:00:00.000Z","dueDate":"2022-03-17T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability","description":"A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-0154","label":"nvd.nist.gov/vuln/detail/CVE-2018-0154"}],"vendor":"Cisco","product":"IOS Software","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-03T00:00:00.000Z","dueDate":"2022-03-17T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability","description":"A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-0154","label":"nvd.nist.gov/vuln/detail/CVE-2018-0154"}],"vendor":"Cisco","product":"IOS Software","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-399","name":"Resource Management Errors","description":"Weaknesses in this category are related to improper management of system resources.","type":"category","status":"Draft","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/399.html"}],"affected":[{"vendor":"cisco","product":"ios","name":"ios","label":"ios","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/ios"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/103559","label":"www.securityfocus.com/bid/103559","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dos","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dos","hostname":"tools.cisco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1040585","label":"www.securitytracker.com/id/1040585","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0154","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0154","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-03-28T22:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-03-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-03-17T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-01-12T21:51:50.881Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T02:58:54.737Z","stale":false,"partial":false}}