Skip to content
CVE Tracker
Back

CVE-2018-0484

Cisco IOS and IOS XE Software Secure Shell Connection on VRF Vulnerability

Medium5.3EPSS 0.79%
Published
Updated
Reserved
Assigned by
cisco

Description

A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual routing and forwarding (VRF) instance despite the absence of the vrf-also keyword in the access-class configuration. The vulnerability is due to a missing check in the SSH server. An attacker could use this vulnerability to open an SSH connection to an affected Cisco IOS or IOS XE device with a source address belonging to a VRF instance. Once connected, the attacker would still need to provide valid credentials to access the device.

Scores

CVSS scores of CVE-2018-0484, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.0Medium5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVDNVD · Modified3.0Medium6.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
0.79% · top 44% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

  • Cisco · Cisco IOS

    • affected n/a

What to do

Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .