CVE-2018-0171highunder attackCWE-20

CVE-2018-0171: high-severity vulnerability in Cisco IOS and IOS XE

Published · Updated

Follow this CVE+ Monitor Cisco IOS XE+ Monitor IOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 7.5epss 99%
from disclosure to weapon1 day
Published on NVDMar 28
1st PoC+1d
CISA KEV+1316d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateSalt Typhoon🇨🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Cisco's Smart Install feature allows an attacker to send a specially crafted message over the network, causing the device to crash, hang, or run malicious code without needing to log in first.

Technical detail

The vulnerability stems from improper packet validation in the Smart Install protocol (TCP port 4786), allowing unauthenticated remote attackers to trigger a buffer overflow. Exploitation results in denial of service via device reload or watchdog crash, or arbitrary code execution depending on the attack variant.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · Cisco IOS and IOS XE
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.