CVE-2018-0154
Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability
Published Mar 28, 2018 · updated Jun 16, 2026 · cisco ios
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to hang or crash, resulting in a DoS condition. Cisco Bug IDs: CSCvd39267.
Timeline
Detection, updates, and resolution for this record.
Mar 28, 2018 · Catalog
Detected
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traff
Mar 3, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 17, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient handling of VPN traffic by the affected device. An attacker could exploit this vulnerability by sending crafted VPN traff
Required action
Apply updates per vendor instructions.
CISA due date Mar 17, 2022
Affected
- cpe cisco/iosversion unspecified
- vendor Cisco IOS Softwareversion unspecified
Sources
- CISA KEVCVE-2018-0154
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.
cisa.gov - CVE.orgCVE-2018-0154
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-0154
30-day exploitation probability 7.1%
first.org - NIST NVDCVE-2018-0154
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient h
nvd.nist.gov