A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacke…

Published 8 y ago 2018-03-28 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.1 · CNA

CISA KEV

Yes

added 2021-11-03

EPSS

99.5%

percentile 100%

Public exploits

Exploit-DB · Nuclei check

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.

Known exploited (CISA KEV)

Added: 5 y ago 2021-11-03
Due date: 2022-05-03 (4 y ago)
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Vendor / product: Cisco / IOS and IOS XE
CISA name: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation: Active — exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 23 mo ago 2024-11-08

Exploit prediction (EPSS)

99.48% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

Nuclei template Cisco Smart Install - Configuration Download · nuclei detection template
EDB-44451 Cisco Smart Install - Crash (PoC) · dos · 2018-03-29

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	10.0	`AV:N/AC:L/Au:N/C:C/I:C/A:C`

Affected products

n/a Cisco IOS and IOS XE

Classification

Weakness

CWE-20 Improper Input Validation
CWE-787 Out-of-bounds Write

Technology feeds

Cisco IOS (RSS, critical only)

References

ics-cert.us-cert.gov /advisories/ICSA-18-107-04 · x_refsource_MISC, x_transferred
securitytracker.com /id/1040580 · vdb-entry, x_refsource_SECTRACK, x_transferred
tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2 · x_refsource_CONFIRM, x_transferred
darkreading.com /perimeter/attackers-exploit-cisco-switch-issue-as-vendor-warns-of-yet-another-critical-fl · x_refsource_MISC, x_transferred
ics-cert.us-cert.gov /advisories/ICSA-18-107-05 · x_refsource_MISC, x_transferred
securityfocus.com /bid/103538 · vdb-entry, x_refsource_BID, x_transferred
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0171 · government-resource

Sources

CVE List: CVE-2018-0171
NVD: CVE-2018-0171

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary