CVE-2018-11750

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-02 · updated 2026-06-17
Weakness: CWE-20

Description

Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, host key checking is enabled by default.

Affected products

Puppet Cisco Ios Module: before 0.4.0 — fixed in 0.4.0

How to fix

Upgrade to a fixed version: Puppet Cisco Ios Module 0.4.0. Check the vendor advisory for mitigations.

References

https://puppet.com/security/cve/CVE-2018-11750
https://exchange.xforce.ibmcloud.com/vulnerabilities/150978
https://puppet.com/security/cve/CVE-2018-11750

Get alerted when CVE-2018-11750 or the next vulnerability affects your stack