CVE-2018-0346

CVE-2018-0346 describes a denial-of-service vulnerability in the Zero Touch Provisioning service of Cisco SD-WAN Solution products, including vBond Orchestrator, vManage, and vSmart Controller software, running releases prior to 18.3.0. The vulnerability stems from incorrect bounds checks, leading to a buffer overflow when processing specially crafted packets. An unauthenticated, remote attacker can exploit this by sending malicious packets directly to an affected device, causing it to reload and resulting in a temporary denial of service. The vulnerability has a CVSSv3 score of 7.5 (High), indicating a network-based attack with low complexity and high impact on availability, requiring no privileges or user interaction. While the EPSS score is very low, suggesting minimal exploitability in the wild, the FAUCET Risk Score is moderate at 51/100. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, aligning with the majority of reported vulnerabilities.