Vulnerability Intelligence Report
Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability
CVE-2018-0156
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.
CISA KEV
SSVC: Active Exploitation
Automatable
CVSS Base Score
7.5
HIGH
Exploitability:3.9
Impact Score:3.6
EPSS Probability:8.37%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-399 ↗CWE-399
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| cisco | ios | 15.2\(2\)e4, 15.2\(2a\)ja |
| cisco | catalyst_2960-plus_24lc-l | all |
| cisco | catalyst_2960-plus_24lc-s | all |
| cisco | catalyst_2960-plus_24pc-l | all |
| cisco | catalyst_2960-plus_24pc-s | all |
| cisco | catalyst_2960-plus_24tc-l | all |
| cisco | catalyst_2960-plus_24tc-s | all |
| cisco | catalyst_2960-plus_48pst-l | all |
| cisco | catalyst_2960-plus_48pst-s | all |
| cisco | catalyst_2960-plus_48tc-l | all |
| cisco | catalyst_2960-plus_48tc-s | all |
| cisco | catalyst_2960c-12pc-l | all |
| cisco | catalyst_2960c-8pc-l | all |
| cisco | catalyst_2960c-8tc-l | all |
| cisco | catalyst_2960c-8tc-s | all |
| cisco | catalyst_2960cg-8tc-l | all |
| cisco | catalyst_2960cpd-8pt-l | all |
| cisco | catalyst_2960cpd-8tt-l | all |
| cisco | catalyst_2960s-24pd-l | all |
| cisco | catalyst_2960s-24ps-l | all |
| cisco | catalyst_2960s-24td-l | all |
| cisco | catalyst_2960s-24ts-l | all |
| cisco | catalyst_2960s-24ts-s | all |
| cisco | catalyst_2960s-48fpd-l | all |
| cisco | catalyst_2960s-48fps-l | all |
| cisco | catalyst_2960s-48lpd-l | all |
| cisco | catalyst_2960s-48lps-l | all |
| cisco | catalyst_2960s-48td-l | all |
| cisco | catalyst_2960s-48ts-l | all |
| cisco | catalyst_2960s-48ts-s | all |
| cisco | catalyst_2960s-f24ps-l | all |
| cisco | catalyst_2960s-f24ts-l | all |
| cisco | catalyst_2960s-f24ts-s | all |
| cisco | catalyst_2960s-f48fps-l | all |
| cisco | catalyst_2960s-f48lps-l | all |
| cisco | catalyst_2960s-f48ts-l | all |
| cisco | catalyst_2960s-f48ts-s | all |
| cisco | catalyst_2960x-24pd-l | all |
| cisco | catalyst_2960x-24ps-l | all |
| cisco | catalyst_2960x-24psq-l_cool | all |
| cisco | catalyst_2960x-24td-l | all |
| cisco | catalyst_2960x-24ts-l | all |
| cisco | catalyst_2960x-24ts-ll | all |
| cisco | catalyst_2960x-48fpd-l | all |
| cisco | catalyst_2960x-48fps-l | all |
| cisco | catalyst_2960x-48lpd-l | all |
| cisco | catalyst_2960x-48lps-l | all |
| cisco | catalyst_2960x-48td-l | all |
| cisco | catalyst_2960x-48ts-l | all |
| cisco | catalyst_2960x-48ts-ll | all |
| cisco | catalyst_2960xr-24pd-i | all |
| cisco | catalyst_2960xr-24ps-i | all |
| cisco | catalyst_2960xr-24td-i | all |
| cisco | catalyst_2960xr-24ts-i | all |
| cisco | catalyst_2960xr-48fpd-i | all |
| cisco | catalyst_2960xr-48fps-i | all |
| cisco | catalyst_2960xr-48lpd-i | all |
| cisco | catalyst_2960xr-48lps-i | all |
| cisco | catalyst_2960xr-48td-i | all |
| cisco | catalyst_2960xr-48ts-i | all |
| cisco | catalyst_3560c-12pc-s | all |
| cisco | catalyst_3560c-8pc-s | all |
| cisco | catalyst_3560cg-8pc-s | all |
| cisco | catalyst_3560cg-8tc-s | all |
| cisco | catalyst_3560cpd-8pt-s | all |
| cisco | catalyst_3560x-24p-e | all |
| cisco | catalyst_3560x-24p-l | all |
| cisco | catalyst_3560x-24p-s | all |
| cisco | catalyst_3560x-24t-e | all |
| cisco | catalyst_3560x-24t-l | all |
| cisco | catalyst_3560x-24t-s | all |
| cisco | catalyst_3560x-24u-e | all |
| cisco | catalyst_3560x-24u-l | all |
| cisco | catalyst_3560x-24u-s | all |
| cisco | catalyst_3560x-48p-e | all |
| cisco | catalyst_3560x-48p-l | all |
| cisco | catalyst_3560x-48p-s | all |
| cisco | catalyst_3560x-48pf-e | all |
| cisco | catalyst_3560x-48pf-l | all |
| cisco | catalyst_3560x-48pf-s | all |
| cisco | catalyst_3560x-48t-e | all |
| cisco | catalyst_3560x-48t-l | all |
| cisco | catalyst_3560x-48t-s | all |
| cisco | catalyst_3560x-48u-e | all |
| cisco | catalyst_3560x-48u-l | all |
| cisco | catalyst_3560x-48u-s | all |
| cisco | catalyst_3750x-12s-e | all |
| cisco | catalyst_3750x-12s-s | all |
| cisco | catalyst_3750x-24p-e | all |
| cisco | catalyst_3750x-24p-l | all |
| cisco | catalyst_3750x-24p-s | all |
| cisco | catalyst_3750x-24s-e | all |
| cisco | catalyst_3750x-24s-s | all |
| cisco | catalyst_3750x-24t-e | all |
| cisco | catalyst_3750x-24t-l | all |
| cisco | catalyst_3750x-24t-s | all |
| cisco | catalyst_3750x-24u-e | all |
| cisco | catalyst_3750x-24u-l | all |
| cisco | catalyst_3750x-24u-s | all |
| cisco | catalyst_3750x-48p-e | all |
| cisco | catalyst_3750x-48p-l | all |
| cisco | catalyst_3750x-48p-s | all |
| cisco | catalyst_3750x-48pf-e | all |
| cisco | catalyst_3750x-48pf-l | all |
| cisco | catalyst_3750x-48pf-s | all |
| cisco | catalyst_3750x-48t-e | all |
| cisco | catalyst_3750x-48t-l | all |
| cisco | catalyst_3750x-48t-s | all |
| cisco | catalyst_3750x-48u-e | all |
| cisco | catalyst_3750x-48u-l | all |
| cisco | catalyst_3750x-48u-s | all |
| cisco | catalyst_4500_supervisor_engine_6-e | all |
| cisco | catalyst_4500_supervisor_engine_6l-e | all |
| cisco | catalyst_4900m | all |
| cisco | catalyst_4948e | all |
| cisco | catalyst_4948e-f | all |
| cisco | embedded_service_2020_24tc_con | all |
| cisco | embedded_service_2020_24tc_con_b | all |
| cisco | embedded_service_2020_24tc_ncp | all |
| cisco | embedded_service_2020_24tc_ncp_b | all |
| cisco | embedded_service_2020_con | all |
| cisco | embedded_service_2020_con_b | all |
| cisco | embedded_service_2020_ncp | all |
| cisco | embedded_service_2020_ncp_b | all |
| cisco | ie-3010-16s-8pc | all |
| cisco | ie-3010-24tc | all |
| cisco | ie_2000-16ptc-g | all |
| cisco | ie_2000-16t67 | all |
| cisco | ie_2000-16t67p | all |
| cisco | ie_2000-16tc | all |
| cisco | ie_2000-16tc-g | all |
| cisco | ie_2000-16tc-g-e | all |
| cisco | ie_2000-16tc-g-n | all |
| cisco | ie_2000-16tc-g-x | all |
| cisco | ie_2000-24t67 | all |
| cisco | ie_2000-4s-ts-g | all |
| cisco | ie_2000-4t | all |
| cisco | ie_2000-4t-g | all |
| cisco | ie_2000-4ts | all |
| cisco | ie_2000-4ts-g | all |
| cisco | ie_2000-8t67 | all |
| cisco | ie_2000-8t67p | all |
| cisco | ie_2000-8tc | all |
| cisco | ie_2000-8tc-g | all |
| cisco | ie_2000-8tc-g-e | all |
| cisco | ie_2000-8tc-g-n | all |
| cisco | ie_3000-4tc | all |
| cisco | ie_3000-8tc | all |
| cisco | ios_xe | 15.2\(2\)e4, 15.2\(2a\)ja |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cisco Systems, Inc. · Hosted Service · USA |
| Reserved | 2017-11-27T00:00:00 |
| Published | 2018-03-28T22:00:00 |
| Patch Date | 2018-03-28 |
| Last Updated | 2026-01-12T21:54:00 |
Community Chatter & Buzz