Actively exploited in the wild

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

Cisco - IOS and IOS XE · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2018-0171

CriticalCVSS 9.8KEV

Published: 28/03/2018(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A vulnerability in the Smart Install feature of Cisco IOS and IOS XE Software is caused by improper validation of packet data. An unauthenticated remote attacker can send a crafted Smart Install message to TCP port 4786, causing a buffer overflow that may lead to device reload, arbitrary code execution, or a watchdog crash.

Risk Assessment

Successful exploitation could allow full compromise of the network device or cause a sustained denial of service (DoS), directly threatening the continuity of the organization's network operations.

Recommendation

Disable the Smart Install feature on Cisco IOS/IOS XE devices as soon as possible or apply the available patches, and restrict access to TCP port 4786.

Other vulnerabilities in Cisco IOS Software and Cisco IOS XE Software

CVE-2018-0151CriticalActively exploited
A vulnerability in the QoS subsystem of Cisco IOS and IOS XE Software is due to incorrect bounds checking of values in packets destined for UDP port 18999. An unauthenticated remote attacker can send malicious packets, causing a buffer overflow that may lead to arbitrary code execution with elevated privileges or a device reload.

Original NVD description (English source)

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.