CVE-2018-0163: Cisco IOS

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass the authentication phase on an 802.1x multi-auth port. The vulnerability is due to a logic change error introduced into the code. An attacker could exploit this vulnerability by trying to access an 802.1x multi-auth port after a successful supplicant has authenticated. An exploit could allow the attacker to bypass the 802.1x access controls and obtain access to the network. Cisco Bug IDs: CSCvg69701.

Affected products

• Cisco IOS: version 15.4(3)m6 only; version 15.4(3)m6a only; version 15.4(3)m7 only; version 15.4(3)m7a only; version 15.4(3)m8 only; version 15.4(3.0i)m6 only; …

Published 2018-03-28. Last modified 2026-06-17.