CVE-2018-0156

CVE-2018-0156 is a high-severity (CVSS 7.5) vulnerability in Cisco IOS Software and Cisco IOS XE Software. CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 17, 2022. CISA does not currently list it as used in ransomware campaigns. Cisco has 102 vulnerabilities in the KEV catalog, 7 of them linked to ransomware.

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• http://www.securityfocus.com/bid/103569
• http://www.securitytracker.com/id/1040596
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi
• http://www.securityfocus.com/bid/103569
• http://www.securitytracker.com/id/1040596
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04