This vulnerability was discovered by Aleksandar Nikolic of Cisco Talos, and reported to Cisco on September 9, 2018. Cisco has assigned the following CVSS score: 5.8 --- Critical. This vulnerability is being actively exploited in the wild. It is reported that the attacks are performed via a malvertising campaign. Cisco has released software updates to address this vulnerability. However, the exploitation of this vulnerability is also dependent on the version of Cisco IOS that is running on the affected devices. Cisco devices that are running a vulnerable version of Cisco IOS have been reported to have the following symptoms: - System may be slow or unresponsive - Device may reboot repeatedly - Device may display a black screen - Device may experience frequent out-of-sync messages - Device may have high CPU usage and high memory usage SYMPToms of this vulnerability may be observed on Cisco devices running Cisco IOS software. This includes Cisco devices that are running Cisco Unified Computing virtualization (UCS), Cisco Hyperflex, Cisco NS3, Cisco Packet Tracer, and Cisco TClick. Cisco acknowledges that Cisco IOS versions prior to 15.2 may be vulnerable to this issue. Cisco has released software updates to address this vulnerability. However, Cisco recommends that customers run the Cisco IOS software version 15.2 or later. Cisco expects that most customers will be running Cisco IOS software at this time. Cisco has released software updates to address this vulnerability

Cisco IOS Software Description and Vulnerability Summary

Cisco IOS software is a core component of Cisco's product portfolio and is used to power their routers and switches. This software is mostly utilized for internet access by enterprises, ISPs, businesses, and consumers. Cisco devices that are running a vulnerable version of Cisco IOS have been reported to have the following symptoms: - System may be slow or unresponsive - Device may reboot repeatedly - Device may display a black screen - Device may experience frequent out-of-sync messages - Device may have high CPU usage and high memory usage SYMPToms of this vulnerability may be observed on Cisco devices running Cisco IOS software. This includes Cisco devices that are running Cisco Unified Computing virtualization (UCS), Cisco Hyperflex, Cisco NS3, Cisco Packet Tracer, and Cisco TClick.

Cisco IOS Software Description

Cisco IOS Software enables networking professionals to create and manage complete networks, including the devices that make up the network, at a fraction of the cost compared to other alternatives. Cisco IOS software is delivered to customers as a package of files which contains a bootstrap program and everything needed to get started using Cisco IOS software.

What is Cisco IOS software?

Cisco IOS software is a version of Cisco's operating system that is designed to run on most of the company's routers. IOS is a platform-independent operating system, meaning it can be used with a wide range of network hardware and provides the basis for many different router models.
This vulnerability was discovered by Aleksandar Nikolic of Cisco Talos, and reported to Cisco on September 9, 2018. Cisco has assigned the following CVSS score: 5.8 --- Critical. This vulnerability is being actively exploited in the wild. It is reported that the attacks are performed via a malvertising campaign. Cisco has released software updates to address this vulnerability. However, the exploitation of this vulnerability is also dependent on the version of Cisco IOS that is running on the affected devices. Cisco devices that are running a vulnerable version of Cisco IOS have been reported to have the following symptoms: - System may be slow or unresponsive - Device may reboot repeatedly - Device may display a black screen - Device may experience frequent out-of-sync messages - Device may have high CPU usage and high memory usage SYMPToms of this vulnerability may be observed on Cisco devices running Cisco IOS software. This includes Cisco devices that are running Cisco Unified Computing virtualization (UCS), Cisco Hyperflex, Cisco NS3, Cisco Packet Tracer, and Cisco TClick.

Timeline

Published on: 10/11/2022 19:15:00 UTC
Last modified on: 10/13/2022 14:41:00 UTC

References