CVE-2018-0156 A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a d...
HighCVSS 7.5
EPSS 9.4%
CISA KEV
added 2022-03-03 · due 2022-03-17
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-17
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco ios | = 15.2(2)e4 | No fix listed |
| cisco ios | = 15.2(2a)ja | No fix listed |
| cisco ios xe | = 15.2(2)e4 | No fix listed |
| cisco ios xe | = 15.2(2a)ja | No fix listed |
References
- 103569 third-party-advisory vdb-entry
- 1040596 third-party-advisory vdb-entry
- ics-cert.us-cert.gov third-party-advisory us-government-resource
- ics-cert.us-cert.gov third-party-advisory us-government-resource
- tools.cisco.com vendor-advisory
- www.cisa.gov government-resource us-government-resource