Read the docs
TI-2018-00216 Aliases CVE-2018-0255GHSA-hgmm-mqqv-gqvx

Cross-site request forgery in Cisco Industrial Ethernet Switches

Priority MEDIUM 42CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to insufficient CSRF protection by the device manager web interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow the attacker to submit arbitrary requests to an affected device via the device manager web interface with the privileges of the user. This vulnerability affects the following Cisco Industrial Ethernet (IE) Switches if they are running a vulnerable release of Cisco IOS Software: IE 2000 Series, IE 2000U Series, IE 3000 Series, IE 3010 Series, IE 4000 Series, IE 4010 Series, IE 5000 Series. Cisco Bug IDs: CSCvc96405.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00886 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Industrial Ethernet SwitchesCisco Industrial Ethernet Switches—No fix listedCNA
  • Cisco Industrial Ethernet Switches Vendor— Affected Cisco Industrial Ethernet Switches Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:*15.2(5)eVulnerableCisco
  • cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:* Versions 15.2(5)e Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0255
  2. 2026-10-03 Alias added: GHSA-hgmm-mqqv-gqvx

References

Advisory 1

  • TI-2018-00138 Improper input validation in Cisco IOS and IOS XE KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09019 Improper input validation in Cisco IOS and IOS XE KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-02977 Improper input validation in Cisco IOS and IOS XE Software KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-00135 Memory corruption in Cisco IOS, IOS XE, and IOS XR KEVCVSS 3.1HIGH 8.8
  • TI-2017-04499 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
  • TI-2017-04498 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
See all 617 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences