8.0High KEV

CVE-2018-0175Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

Cisco IOS, IOS XE, and IOS XR Published: 2018-03-29 01:00 (8 years ago)

Known exploited — Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.03.2022. Remediation deadline for US federal agencies: 17.03.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-0175

Description

Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

Weakness (CWE): CWE-119 CWE-134

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
cisco	ios	15.4(3)m4.1
cisco	ios xe	15.4(3)m4.1
cisco	ios xr	15.4(3)m4.1
—	Cisco IOS, IOS XE, and IOS XR	Cisco IOS, IOS XE, and IOS XR

References and patches

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp Vendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 Third Party AdvisoryUS Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 Third Party AdvisoryUS Government Resource
1040586 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 Third Party AdvisoryUS Government Resource
103564 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0175 US Government Resource

CPE matches (NVD) (9)

cpe:2.3:o:cisco:ios:15.4\(3\)m4.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:15.4\(3\)m4.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xr:15.4\(3\)m4.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:* ≤ 15.2\(4a\)ea5
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* ≤ 15.2\(4a\)ea5
cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:* ≤ 15.2\(6\)e0a
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* ≤ 15.2\(6\)e0a
cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:* ≤ 15.6.3m1
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:* ≤ 15.6.3m1

CVSS score

8.0High

Source: CISA-ADP · CVSS 3.1

Attack vector: Adjacent
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	8.0High
nvd	CVSS 3.1	8.0High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.0High
nvd	CVSS 2.0	7.9High

EPSS (chance of exploitation in 30 days)

3.48%

higher than 89% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2017-11-27
Published2018-03-29 01:00
Reached IP-DB2026-10-24 23:33
Added to KEV2022-03-03
Last updated2026-06-17 04:30

Assigned by (CNA): cisco
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Cisco IOS / IOS XE / ASA

8.6High

CVE-2026-76418 KEV 6 days ago

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unex…

7.5High

CVE-2026-76505 13 days ago

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability

Cisco Cisco IOS XR Software

A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, r…

5.8Medium

CVE-2026-76489 13 days ago

Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection…

5.3Medium

CVE-2026-76445 13 days ago

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulner…

7.5High

CVE-2026-20356 13 days ago

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…

7.5High

CVE-2026-20236 13 days ago

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software