TI-2018-00138 Aliases CVE-2018-0171 GHSA-4w6g-87mh-x63x

Improper input validation in Cisco IOS and IOS XE

CRITICAL 100Exploited in the wildCWE-20Published 2018-03-28 · Updated 2026-01-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03

EPSS 0.99479 99th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Cisco IOS and IOS XE	Cisco IOS and IOS XE	—	No fix listed	CNA

Cisco IOS and IOS XE Vendor— Affected Cisco IOS and IOS XE Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:ios:15.2\(5\)e:::::::*	15.2(5)e	Vulnerable	Cisco

cpe:2.3:o:cisco:ios:15.2\(5\)e:*:*:*:*:*:*:* Versions 15.2(5)e Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2021-11-03 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2018-0171
2026-10-03 Alias added: GHSA-4w6g-87mh-x63x

References

Advisory 3

Other 1

https://www.darkreading.com/perimeter/attackers-exploit-cisco-switch-issue-as-vendor-warns-of-yet-another-critical-flaw/d/d-id/1331490

TI-2017-09019 Improper input validation in Cisco IOS and IOS XE KEVCVSS 3.1CRITICAL 9.8
TI-2017-02977 Improper input validation in Cisco IOS and IOS XE Software KEVCVSS 3.1CRITICAL 9.8
TI-2018-00135 Memory corruption in Cisco IOS, IOS XE, and IOS XR KEVCVSS 3.1HIGH 8.8
TI-2017-04499 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
TI-2017-04498 Memory corruption in Cisco IOS KEVCVSS 3.1HIGH 8.8
TI-2017-04497 Memory corruption in Cisco IOS XE Software KEVCVSS 3.1HIGH 8.8

See all 617 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences