{"id":"CVE-2018-0125","published":"2018-02-08T07:29:00Z","modified":"2026-06-17T01:29:37Z","title":"Cisco VPN Routers Remote Code Execution Vulnerability","vendor":"Cisco","product":"VPN Routers","tier":"core","eol":null,"description":{"text":"A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to an incomplete input validation on user-controlled input in an HTTP request to the targeted device. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user and gain full control of the affected system or cause it to reload, resulting in a DoS condition. This vulnerability is fixed in firmware version 1.0.1.11 for the following Cisco products: RV132W ADSL2+ Wireless-N VPN Router and RV134W VDSL2 Wireless-AC VPN Router. Cisco Bug IDs: CSCvg92737, CSCvh60170.","provenance":"source","from":"NVD"},"summary":{"text":"The web interface of Cisco VPN Routers, specifically the RV132W ADSL2+ Wireless-N VPN Router and RV134W VDSL2 Wireless-AC VPN Router, fails to fully validate user-controlled input in HTTP requests, which is an improper input validation flaw. An unauthenticated remote attacker who can reach the device over the network and send a crafted HTTP request can execute arbitrary code as root, gaining full control of the system, or cause it to reload and produce a denial of service, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:03Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.55186,"percentile":0.99025,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-0125","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-25","exploitedFirstSeen":"2022-03-25","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://securityaffairs.co/wordpress/139821/security/cisco-old-vulnerabilities-exploitation.html","date":"2022-12-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-04-02&host_type=src&vulnerability=cve-2018-0125","date":"2026-04-02"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://www.securityfocus.com/bid/103140","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040336","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x","tags":["Broken Link","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/103140","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040336","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0125","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploit of web interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an unauthenticated, remote attacker to execute arbitrary code","start":120,"end":193}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution as root","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could allow the attacker to execute arbitrary code as the root user","start":648,"end":715}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: crafted request causes device reload DoS","mappingType":"primary_impact","evidence":[{"from":"description","quote":"cause an affected system to reload, resulting in a denial of service","start":312,"end":380}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-0948","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0948","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059","T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2018-02-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0125","provenance":"source"},{"date":"2022-03-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0948","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1506},"priority":{"score":64.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1679 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.8,"detail":"percentile 0.9902"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}