CVE-2018-0480

{"id": "CVE-2018-0480", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 1.6}]}, "published": "2018-10-05T14:29:05.560", "references": [{"url": "http://www.securityfocus.com/bid/105400", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1041737", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-errdisable", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the errdisable per VLAN feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause the device to crash, leading to a denial of service (DoS) condition. The vulnerability is due to a race condition that occurs when the VLAN and port enter an errdisabled state, resulting in an incorrect state in the software. An attacker could exploit this vulnerability by sending frames that trigger the errdisable condition. A successful exploit could allow the attacker to cause the affected device to crash, leading to a DoS condition."}, {"lang": "es", "value": "Una vulnerabilidad en la caracter\u00edstica errdisable per VLAN en Cisco IOS XE Software podr\u00eda permitir que un atacante adyacente sin autenticar haga que el dispositivo se cierre inesperadamente, provocando una denegaci\u00f3n de servicio (DoS). La vulnerabilidad se debe a una condici\u00f3n de carrera que ocurre cuando VLAN y el puerto entran en estado errdisabled, lo que resulta en un estado incorrecto en el software. Un atacante podr\u00eda explotar esta vulnerabilidad enviando frames que desencadenan la condici\u00f3n errdisabled. Si se explota con \u00e9xito, podr\u00eda permitir que el atacante consiga que el dispositivo afectado se cierre inesperadamente, provocando una denegaci\u00f3n de servicio (DoS)."}], "lastModified": "2019-10-09T23:32:10.413", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:3.6\\(5\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "462E6E9F-24A7-4C18-A880-E4CD54722988"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}