What’s Vulnerable › Vulnerabilities

CVE-2018-18508

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-22 · updated 2026-06-17
• Weakness: CWE-476

Description

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Affected products

• Mozilla Network Security Services: before 3.36.7; from 3.41 before 3.41.1 — fixed in 3.36.7, 3.41.1
• Siemens Ruggedcom Rox Mx5000 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1400 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1500 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1501 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1510 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1511 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1512 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx5000 Firmware: before 2.14.0 — fixed in 2.14.0

How to fix

Upgrade to a fixed version: Mozilla Network Security Services 3.36.7, 3.41.1; Siemens Ruggedcom Rox Mx5000 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1400 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1500 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1501 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1510 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1511 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1512 Firmware 2.14.0; Siemens Ruggedcom Rox Rx5000 Firmware 2.14.0. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.7_release_notes
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.41.1_release_notes
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
• https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.7_release_notes
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.41.1_release_notes
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04

Get alerted when CVE-2018-18508 or the next vulnerability affects your stack