A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.
CVE-2018-0101
CRITICALNVD 10.010.0—Elevated
EchelonGraph scoreHIGH confidence
Score elevated to 10.0 because EPSS predicts 93% probability of exploitation within the next 30 days (top 0.2% of all CVEs). NVD baseline CVSS 10.0 retained for reference. Confidence: see factors.
Triggered by: EPSS exploit prediction ≥85%
Sources: epss, ghsa, nvd
10.0
EchelonGraph verdictPatch this weekExploitation is likely or a public exploit exists.
- High exploitation likelihood — EPSS 87%
CISA-KEV: Not listedEPSS: 87%CVSS: 10.0Exploit: NoneExposed: 0
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 10.0
- EG Score
- 10.0(high)
- EPSS
- 99.7%
- KEV
- Not listed
Published
January 29, 2018
Last Modified
November 21, 2024
Advisory Details (6)
Auto-updated Jul 11, 2026🔬 Proof of concept available. No patch confirmed yet.
generic
Thoughts on the handling CVE-2018-0101 / Cisco Bug CSCvg35618 – I CAN'T HACK IT …OR CAN I?
https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618/generic🟡 PoC Available
Cisco ASA - Crash (PoC) - Hardware dos Exploit
https://www.exploit-db.com/exploits/43986/generic
Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1Frequently asked(5)
What is CVE-2018-0101?
CVE-2018-0101 is a critical vulnerability published on January 29, 2018. A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a…
When was CVE-2018-0101 disclosed?
CVE-2018-0101 was first published in the National Vulnerability Database on January 29, 2018, with the most recent update on November 21, 2024. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2018-0101 actively exploited?
CVE-2018-0101 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 99.7% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2018-0101?
CVE-2018-0101 has a CVSS v3 base score of 10.0 (NVD).
How do I remediate CVE-2018-0101?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2018-0101, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2018-0101
Is Your Infrastructure Affected by CVE-2018-0101?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.