Denial of Service Vulnerability in Cisco Virtualized Packet Core-Distributed Instance Software

CVE-2018-0117

Summary

A vulnerability exists in the ingress packet processing capabilities of Cisco's Virtualized Packet Core-Distributed Instance (VPC-DI) Software, allowing an unauthenticated remote attacker to exploit it. By sending specially crafted traffic to the internal distributed instance network address, an attacker can trigger an unhandled error condition that forces both control function (CF) instances to reload, effectively disconnecting all subscribers and causing a complete denial of service. This poses significant risks to network continuity and service availability across affected systems running Cisco StarOS versions 19.2 to 21.3.

References