Skip to content
fr Sign in
Not rated

CVE-2018-15369 A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an…

Description

A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of crafted TACACS+ response packets by the affected software. An attacker could exploit this vulnerability by injecting a crafted TACACS+ packet into an existing TACACS+ session between an affected device and a TACACS+ server or by impersonating a known, valid TACACS+ server and sending a crafted TACACS+ packet to an affected device when establishing a connection to the device. To exploit this vulnerability by using either method, the attacker must know the shared TACACS+ secret and the crafted packet must be sent in response to a TACACS+ request from a TACACS+ client. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Affected products and versions

Product Affected versions Fixed in
Cisco IOS Software Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco IOS Software

The 12 CVEs of Cisco IOS Software →
CVE-2019-1758 A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an… 4.7 Medium CVE-2019-1751 A vulnerability in the Network Address Translation 64 (NAT64) functions of Cisco IOS Software could allow an… 8.6 High CVE-2018-15375 A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services… Not rated CVE-2018-15373 A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE… Not rated
Track this CVE