CVE-2018-0171

Cisco IOS and IOS XE: Software Smart Install Remote Code Execution

As of , CVE-2018-0171 in Cisco IOS and IOS XE is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 3 November 2021
US federal deadline
3 May 2022181 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
Public exploit
1 Exploit-DB entry
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.

CISA's description

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.

The CVE record's description, from cisco

CVE published
28 March 2018
Assigned by
cisco
CVSS
7.5 High (CVSS 3.1, from CISA-ADP)
CWE-20
Improper Input Validation
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. Exploit-DB published an exploit (EDB-ID 44451).
  3. CISA added it to its list of exploited vulnerabilities.
  4. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

IOS and IOS XE: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2017-3881Remote Code ExecutionCisco IOS and IOS XEPatch this weekMetasploit module; EPSS 0.990.99
CVE-2025-20352Software SNMP Denial of Service and Remote Code ExecutionCisco IOS and IOS XEPatch soon0.39
CVE-2023-20109Group Encrypted Transport VPN Out-of-Bounds WriteCisco IOS and IOS XEPatch soon0.02

Read further