CVE-2018-0131CWE-326

A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker…

published August 14, 2018

CVSS
—
EPSS
2%
Percentile
77.0
In the wild
Unconfirmed
What it is

A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to obtain the encrypted nonces of an Internet Key Exchange Version 1 (IKEv1) session. The vulnerability exists because the affected software responds incorrectly to decryption failures. An attacker could exploit this vulnerability sending crafted ciphertexts to a device configured with IKEv1 that uses RSA-encrypted nonces. A successful exploit could allow the attacker to obtain the encrypted nonces. Cisco Bug IDs: CSCve77140.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01700 · 77.0th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2018-08-14T17:00Z
EPSS history
Timeline
  • 14 AUG 17:00Z
    A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker…
    cvelistv5