CVE-2018-0395: cisco cisco nx-os software Improper Input Validation
Vulnerability summary
CVE-2018-0395 is a high (CVSS 8.8) Improper Input Validation vulnerability in cisco cisco nx-os software. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.3% of scored vulnerabilities.
Timeline
- 17-10-2018PublishedVulnerability first disclosed.
- 26-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface on the targeted device. A successful exploit could allow the attacker to cause the switch to reload unexpectedly.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.3MediumCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.79% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco4 products
- cisco nx-os software≥ unspecified, < 6.2(1)
- firepower 4100 series next-generation firewalls≥ unspecified, < <2.3.1.58
- firepower_extensible_operating_systemr231
- nx-os6.0\(4\) | 6.1\(3\)s2 | r231 | 12.3\(1e\) | 3.2\(3d\)c
1 vendor · 4 products
References
3 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-fxnx-os-dosVendor AdvisoryX Refsource CISCO