CVE-2018-0484

Name: CVE-2018-0484
Creator: NVD / NIST
Published: 2019-01-10T18:29:00.377+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.79%

Last modified Jun 17, 2026

CVE-2018-0484 is a vulnerability of currently unknown severity. A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual routing and forwarding (VRF) instance despite the absence of the vrf-also keyword in the access-class configuration. The vulnerability is due to a missing check in the SSH server. EPSS estimates a 0.79% chance of exploitation in the next 30 days.

Description

A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual routing and forwarding (VRF) instance despite the absence of the vrf-also keyword in the access-class configuration. The vulnerability is due to a missing check in the SSH server. An attacker could use this vulnerability to open an SSH connection to an affected Cisco IOS or IOS XE device with a source address belonging to a VRF instance. Once connected, the attacker would still need to provide valid credentials to access the device.

Metrics

EPSS Probability

0.79%

51.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-284

Affected Software

Vendor	Product	Versions
Cisco	Ios	16.6.2
Cisco	Ios	16.6.4

References

http://www.securityfocus.com/bid/106560Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ios-ssh-vrfVendor Advisory
http://www.securityfocus.com/bid/106560Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ios-ssh-vrfVendor Advisory

Timeline

Published: Jan 10, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-0484?

How severe is CVE-2018-0484?

Severity scoring for CVE-2018-0484 is pending analysis. The EPSS model estimates a 0.79% probability of exploitation in the next 30 days.

How do I fix CVE-2018-0484?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-0484?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST