HowToFixMe
● High · CVSS 8.6 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2018-0158: Improper input validation in Cisco IOS and IOS XE

⚡ At a glance
Severity8.6 (High) · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
ImpactDenial of service (memory leak + device reload). no data exposure
Actively exploited?Yes, listed in CISA KEV (added 2022-03-03)
Vendor / productCisco, IOS and IOS XE Software (IKEv2 module)
Fixed inPer-platform fixed builds in cisco-sa-20180328-ike: use the Cisco Software Checker
Type (CWE)CWE-20: improper input validation

Exploitation status

CVE-2018-0158 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: although a public exploit is not directly linked in this CVE’s primary references, its place on the CISA KEV catalog confirms working attack code is in active use in the wild, treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-17. Treat it as active exploitation, not theoretical.

What is CVE-2018-0158?

CVE-2018-0158 is a denial-of-service flaw in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software. An unauthenticated, remote attacker who can send crafted IKEv2 packets to the device triggers a memory leak: the device keeps consuming memory until it runs out and reloads. Cisco tracks the underlying defect as bug ID CSCvf22394 and documents it in advisory cisco-sa-20180328-ike.

The root cause is classified as CWE-20 (improper input validation). the IKEv2 code does not correctly process certain malformed packets. Be precise about the impact: this is purely an availability problem. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, scoring 8.6. The C:N/I:N means there is no data theft and no configuration tampering; the A:H with a changed scope reflects that a single packet stream can take a router, firewall, or VPN headend offline. For an internet-facing VPN aggregator, that is still a serious outage.

There is one practical nuance that decides whether you are even reachable: the bug lives in the IKEv2 process. A device that has never enabled IKEv2, no crypto ikev2 configuration, no FlexVPN, no IKEv2 profile, and nothing listening on UDP 500 or 4500: does not expose this attack surface. Confirm that before you decide how urgent the upgrade is.

How to confirm you are exposed

Everything here runs on the Cisco device itself, from privileged EXEC mode. First, check whether IKEv2 is even running and which build you are on:

# On the Cisco IOS / IOS XE device, in enable mode
show version | include (Version|IOS)
show crypto ikev2 sa          ! lists active IKEv2 security associations
show udp | include (500|4500) ! confirms IKE/NAT-T ports are listening
show processes memory sorted  ! watch for a steadily growing IKEv2 process

If show crypto ikev2 sa returns sessions (or the IKEv2 profile is configured) and UDP 500/4500 are open to untrusted networks, the device is in scope. Note the exact image string from show version, you will paste your platform and that train into the Cisco Software Checker to find the fixed build, because the patched release differs per platform and is not a single global version.

A device that is leaking memory because of active exploitation shows a continuously climbing value for the IKEv2-related process in show processes memory sorted, often followed by %SYS-2-MALLOCFAIL messages in the log and an unexpected reload. If you see that pattern on an IKEv2-enabled box, prioritise the upgrade immediately.

How to fix CVE-2018-0158

The fix is to upgrade Cisco IOS or IOS XE to a build that Cisco has marked as fixed for this defect. Cisco did not publish a single universal version number; the corrected release depends on your hardware platform and the IOS train you currently run. The authoritative way to get yours:

  1. Open advisory cisco-sa-20180328-ike and use the embedded Cisco Software Checker. Enter your platform and current release (the string from show version); it returns the exact First Fixed release for your case.
  2. Download that image from Cisco Software Central with a valid service contract.
  3. Verify the image hash Cisco publishes before you stage it on the device.

The upgrade itself follows the standard IOS image-replacement procedure on the device:

# On the Cisco IOS / IOS XE device, in enable mode
enable
show version | include Version
copy running-config startup-config        ! save current config

# Verify free flash, then copy the Cisco-supplied fixed image
dir flash:
verify /md5 flash:<fixed-image>.bin       ! compare to the hash on Cisco's download page

# Point the device at the new image and reload during a maintenance window
configure terminal
 boot system flash:<fixed-image>.bin
 no boot system flash:<old-image>.bin
end
write memory
reload

Replace <fixed-image>.bin with the filename of the release the Software Checker gave you, and <old-image>.bin with your current boot image. On IOS XE platforms that use the install mode rather than bundle mode, use install add file ... activate commit instead of editing boot system. After the reload, run show version | include Version and confirm the device booted the fixed release.

If you can't upgrade immediately

If you cannot schedule the IOS reload right away, reduce who can reach the IKEv2 process. None of these replace the upgrade. they only shrink the attack surface for a vulnerability that is being actively exploited.

Restrict IKE reachability with a control-plane ACL

If your IKEv2 peers are a known set of remote sites or clients, permit UDP 500/4500 only from those peers and drop the rest. Apply it with Control Plane Policing or as an interface ACL on the untrusted edge:

# On the Cisco IOS / IOS XE device, allow IKE only from known VPN peers
configure terminal
ip access-list extended IKE-PEERS
 permit udp host 203.0.113.10 any eq isakmp
 permit udp host 203.0.113.10 any eq non500-isakmp
 permit udp host 198.51.100.20 any eq isakmp
 permit udp host 198.51.100.20 any eq non500-isakmp
 deny   udp any any eq isakmp
 deny   udp any any eq non500-isakmp
 permit ip any any
exit
interface GigabitEthernet0/0          ! the untrusted/WAN interface
 ip access-group IKE-PEERS in
end
write memory

Replace the host addresses with your real peer IPs. isakmp is UDP 500 and non500-isakmp is UDP 4500 (NAT-T). If IKEv2 is configured but genuinely unused, the cleanest mitigation is to remove the IKEv2 configuration entirely until you patch.

Protect the management plane

Independently of IKE, lock administrative access to a trusted subnet so an attacker cannot pivot if the box is unstable:

# On the Cisco IOS / IOS XE device: restrict VTY (SSH) access
configure terminal
access-list 99 permit 10.0.0.0 0.255.255.255
line vty 0 15
 access-class 99 in
 transport input ssh
end
write memory

Verify the fix held

After the upgrade, confirm three things on the device: the build is the fixed release, IKEv2 is healthy, and memory is stable.

# On the Cisco IOS / IOS XE device, in enable mode
show version | include Version             ! must match the fixed release from the Software Checker
show crypto ikev2 sa                       ! tunnels should re-establish normally
show processes memory sorted               ! IKEv2 process memory should now be stable
show logging | include MALLOCFAIL          ! should be empty after the reload

Expected result: the reported version equals the First Fixed release Cisco's Software Checker returned for your platform, IKEv2 SAs come back up for your legitimate peers, and the IKEv2 process memory no longer climbs under traffic. Because this CVE is on the CISA KEV list, record the upgrade date and target build in your change log so you can evidence remediation during an audit.

Frequently asked questions

What does an attacker actually gain from CVE-2018-0158?

Denial of service only. Crafted IKEv2 packets force the device to leak memory until it exhausts free memory and reloads. The CVSS vector is C:N/I:N/A:H, so there is no data disclosure and no configuration tampering, but a router or VPN headend that keeps reloading is a full outage for everything behind it.

We don't run any IKEv2 VPNs. Are we still at risk?

Only if the IKEv2 process is active. The flaw is specifically in the IKEv2 module, so a device with no crypto ikev2 configuration that is not listening on UDP 500/4500 is not reachable through this path. Verify with show crypto ikev2 sa and show udp before deciding you are unaffected.

Is there a single fixed IOS version?

No. Cisco published fixed builds in cisco-sa-20180328-ike, but the First Fixed release depends on your platform and current train. The MITRE record lists no single version, so run the Cisco Software Checker on that advisory with your exact model and release to get the correct target build.

Why is this rated 8.6 if it can't steal data?

The scope is "changed" and availability impact is "high": an unauthenticated packet stream from anywhere on the network can knock out a device that often sits at a network boundary. Availability-only flaws still score highly when they are remotely triggerable without authentication and the affected device is critical, which is exactly the case here.

Is CVE-2018-0158 actually being exploited?

According to the data sources above, yes, CISA has it listed as actively exploited. Either way, the fix is the same: apply the vendor patch.

Do I need to reboot after patching?

For OS or kernel updates, yes. For most userland packages a systemctl restart <service> is enough. Any process that loaded the old shared library keeps using it until restarted, so when in doubt, reboot.

What is the CVSS score?

8.6 (high). Refer to the vendor advisory for the exact vector string.

Where is the official advisory?

See the References section at the bottom of this page; the vendor's URL is the authoritative source for affected builds and patched versions.

References

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Other CVEs touching related code paths, worth patching together with this one:

People also ask

Is CVE-2018-0158 actually being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03, so working exploit code is in active use against unpatched Cisco IOS and IOS XE devices. Treat the upgrade as an emergency change.

What does an attacker actually gain from CVE-2018-0158?

Denial of service only. Crafted IKEv2 packets force the device to leak memory until it reloads. The CVSS vector is C:N/I:N/A:H. no data disclosure, no config tampering, but a router or VPN headend reloading is a full outage.

We don't run any IKEv2 VPNs. Are we still at risk?

Only if the IKEv2 process is active. The flaw is in the IKEv2 module, so a device with no crypto ikev2 configuration that is not listening on UDP 500/4500 is not reachable through this path. Verify with show crypto ikev2 sa first.

Is there a single fixed IOS version?

No. Cisco published fixed builds in cisco-sa-20180328-ike, but the First Fixed release depends on your platform and train. Run the Cisco Software Checker with your exact model and release to get the correct target build.