CVE-2018-0175highunder attackCWE-119

CVE-2018-0175: high-severity vulnerability in Cisco IOS, IOS XE, and IOS XR

Published · Updated

Follow this CVE+ Monitor Cisco IOS XE+ Monitor IOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8epss 3.5%
from disclosure to weapon
Published on NVDMar 28
CISA KEV+1436d
Action required by CISAfederal deadline: 2022-03-17

Apply updates per vendor instructions.

In short

A format string flaw in Cisco's LLDP protocol handling allows an attacker on the same network to crash the device or run malicious code with high privileges. This matters because LLDP is used for device discovery, making any network neighbor a potential threat.

Technical detail

Format string vulnerability in LLDP subsystem allows adjacent, unauthenticated attackers to trigger memory corruption or code execution via specially crafted LLDP packets. Pre-condition: victim device must be running affected Cisco IOS/IOS XE/IOS XR versions with LLDP enabled. Impact includes denial of service and arbitrary code execution with elevated privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · Cisco IOS, IOS XE, and IOS XR