Read the docs
TI-2018-00063 Aliases CVE-2018-0088GHSA-3mrm-rr7c-34fm

Resource management flaw in Cisco IOS

Priority LOW 32CWE-399Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

A vulnerability in one of the diagnostic test CLI commands on Cisco Industrial Ethernet 4010 Series Switches running Cisco IOS Software could allow an authenticated, local attacker to impact the stability of the device. This could result in arbitrary code execution or a denial of service (DoS) condition. The attacker has to have valid user credentials at privilege level 15. The vulnerability is due to a diagnostic test CLI command that allows the attacker to write to the device memory. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a specific diagnostic test command at the CLI. An exploit could allow the attacker to overwrite system memory locations, which could have a negative impact on the stability of the device. Cisco Bug IDs: CSCvf71150.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco IOSCisco IOS—No fix listedCNA
  • Cisco IOS Vendor— Affected Cisco IOS Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:cisco:industrial_ethernet_4010_series_firmware:*:*:*:*:*:*:*:*all versionsVulnerableCisco
cpe:2.3:h:cisco:ie-4010-16s12p:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:ie-4010-4s24p:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:industrial_ethernet_4010_series_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Cisco
  • cpe:2.3:h:cisco:ie-4010-16s12p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:ie-4010-4s24p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0088
  2. 2026-10-03 Alias added: GHSA-3mrm-rr7c-34fm

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences