CVE-2018-0189

CVE-2018-0189 is a medium-severity vulnerability in Cisco Ios Xe with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-399.

Key facts

Description

A vulnerability in the Forwarding Information Base (FIB) code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, network attacker to cause a denial of service (DoS) condition. The vulnerability is due to a limitation in the way the FIB is internally representing recursive routes. An attacker could exploit this vulnerability by injecting routes into the routing protocol that have a specific recursive pattern. The attacker must be in a position on the network that provides the ability to inject a number of recursive routes with a specific pattern. An exploit could allow the attacker to cause an affected device to reload, creating a DoS condition. Cisco Bug IDs: CSCva91655.

Frequently asked questions

What is CVE-2018-0189?
A vulnerability in the Forwarding Information Base (FIB) code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, network attacker to cause a denial of service (DoS) condition. The vulnerability is due to a limitation in the way the FIB is internally representing recursive routes. An attacker could exploit this vulnerability by injecting routes into the routing protocol that have a specific recursive pattern. The attacker must be in a position on the network that provides the ability to inject a number of recursive routes with a specific pattern. An exploit could allow the attacker to cause an affected device to reload, creating a DoS condition. Cisco Bug IDs: CSCva91655.
How severe is CVE-2018-0189?
CVE-2018-0189 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2018-0189 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-0189?
CVE-2018-0189 affects Cisco Ios Xe. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-0189?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-0189 published?
CVE-2018-0189 was published on 2018-03-28 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Cisco Ios Xe

All CVEs affecting Cisco Ios Xe →

Other CWE-399 (Resource Management Errors) vulnerabilities

Browse all CWE-399 (Resource Management Errors) vulnerabilities →