Skip to content

CVE · Exploited · On CISA KEV

CVE-2018-0171

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

9.8
CVSS 3.1
1
story
NOV 3
added to KEV
Severity
9.8 Critical · NVD score
Vendor
Cisco
Product
IOS and IOS XE
Published
Mar 28, 2018
Added to KEV
Nov 3, 2021
KEV deadline
May 3, 2022
Ransomware use
Unknown
Weakness
CWE-20, CWE-787
Part of Salt Typhoon Telecom Hacks →

What it is

Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. IntrusionsUS Gov Links Private Chinese Firms to Salt Typhoon HacksSalt Typhoon has not been observed exploiting zero-day flaws, but instead targeting known bugs in exposed network edge devices – some of which are years old.LINDSEY O'DONNELL-WELCH · 3 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorytools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2Vendor advisorytools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2Analysissecurityfocus.com/bid/103538Analysissecuritytracker.com/id/1040580