Is CVE-2018-0159 actively exploited?

Yes. CVE-2018-0159 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2018-0159 be exploited remotely?

The attack vector of CVE-2018-0159 has not been classified yet.

What is the CVSS score of CVE-2018-0159?

CVE-2018-0159 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2018-0159

HIGHCISA KEVIN THE WILD

CVE-2018-0159

Published: March 3, 2022

EPSS:5.25%probability of exploitation in 30 daysPercentile:89.8th

Official Description

A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.

NVD Source

CISA KEV Advisory

Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability

Added to KEV: 2022-03-03Federal patch deadline: 2022-03-17

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This Cisco IOS and IOS XE vulnerability in the IKEv1 functionality allows an unauthenticated, remote attacker to trigger a device reload, leading to a denial-of-service condition. Its inclusion in the KEV catalog signifies confirmed exploitation, making it a critical issue.

Active exploitation of this vulnerability has been observed in the wild. The flaw is remotely exploitable and does not require authentication.

Recommended Action

Apply the latest security updates for Cisco IOS and IOS XE to address this denial-of-service vulnerability.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2018-0159 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2018-0159 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.