Vulnerability record · CVE-2018-0158 · published 28 March 2018
CVE-2018-0158: Cisco IOS and IOS XE IKEv2 packet handling memory leak DoS
Cisco · Ios
Cisco IOS and IOS XE mishandle certain IKEv2 packets, causing improper input validation that leaks memory. Repeated crafted packets drive continuous memory consumption until the device reloads, producing a denial of service. The flaw is remotely reachable without authentication, so any internet-exposed IKEv2 endpoint is at risk.
Description
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated remote denial of service with a CVSS of 8.6 and confirmed inclusion in CISA's KEV catalog, though no ransomware use is documented.
What it is
Cisco IOS and IOS XE mishandle certain IKEv2 packets, causing improper input validation that leaks memory. Repeated crafted packets drive continuous memory consumption until the device reloads, producing a denial of service. The flaw is remotely reachable without authentication, so any internet-exposed IKEv2 endpoint is at risk.
Impact
An unauthenticated remote attacker can exhaust device memory and force a reload, taking the affected router or switch offline. No data confidentiality or integrity loss is described; the gain is purely availability disruption.
Attack surface
Reached over the network via the IKEv2 service (UDP 500/4500) on affected devices; the CVSS vector shows no privileges and no user interaction required. Any device with IKEv2 enabled and reachable from untrusted networks is exposed.
Exploitation
CVE-2018-0158 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating real-world exploitation, and EPSS gives a 30-day probability of about 7.2 percent (94th percentile). No public exploit code or ransomware use is documented in this record.
What to do
- Apply the Cisco IOS/IOS XE updates referenced in Cisco advisory cisco-sa-20180328-ike; this is the required KEV action.
- If patching cannot be done immediately, restrict IKEv2 (UDP 500/4500) to trusted peers with ACLs or infrastructure access lists.
- Disable IKEv2 on devices that do not need it.
- Monitor device memory and reload events on IKEv2-enabled systems for signs of the leak.
- Track the KEV due date (2022-03-17) and confirm remediation status for all affected devices.
Detection
- Alert on sustained memory growth or unexpected reloads on IKEv2-enabled Cisco IOS/IOS XE devices.
- Log and review IKEv2 packet rates and malformed IKEv2 traffic from untrusted sources.
- Correlate device syslog reload or crash messages with IKEv2 activity in the preceding window.
- Inventory IKEv2-exposed devices and verify they are patched against the Cisco advisory.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2018-0158 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 March 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-0158 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-0158), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
