CVE-2018-0151: Cisco IOS/IOS XE QoS UDP Port 18999 Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote code execution, and confirmed exploitation in CISA KEV make this a top remediation priority.

What it is

Cisco IOS and IOS XE contain a buffer overflow in the QoS subsystem caused by incorrect bounds checking of values in packets sent to UDP port 18999. An unauthenticated remote attacker can send crafted packets to trigger the overflow, leading to code execution with elevated privileges or a device reload. The flaw is critical because it is network-reachable without credentials and affects core routing and switching platforms.

Impact

An attacker can execute arbitrary code with elevated privileges on the affected device or force it to reload, causing a denial of service. Code execution on a network device can allow persistent control, traffic manipulation, or use as a pivot into the network.

Attack surface

The vulnerability is reached by sending malicious packets destined to UDP port 18999 on an affected device; the CVSS vector shows network access, no privileges, and no user interaction. Only traffic destined to and processed by the device triggers it, not traffic transiting the device.

Exploitation

CVE-2018-0151 is listed in CISA KEV with a 2022-03-03 addition date, indicating known exploitation in the wild. EPSS shows a 30-day probability of 0.14197 (96th percentile), and references include vendor and US government advisories.

What to do

• Apply the Cisco IOS/IOS XE updates referenced in the vendor advisory cisco-sa-20180328-qos as the primary fix.
• If immediate patching is not possible, restrict or block UDP port 18999 to affected devices using infrastructure ACLs or control-plane policing.
• Disable or restrict unnecessary QoS features and services on exposed devices where operationally feasible.
• Monitor Cisco security advisories and CISA KEV for updated guidance and ensure devices are not exposed to untrusted networks.
• Verify device integrity after suspected exploitation by checking for unexpected reloads, configuration changes, or unauthorized code.

Detection

• Monitor network traffic and firewall logs for UDP packets destined to port 18999 on Cisco IOS/IOS XE devices.
• Alert on unexpected device reloads or crashes in QoS-related processes on affected Cisco devices.
• Review device logs and syslog for QoS subsystem errors, buffer overflow indicators, or anomalous process behavior.
• Use network flow data to identify external hosts sending traffic to UDP 18999 on internal routing and switching infrastructure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.