← Vulnerability feed

Vulnerability record · CVE-2018-0156 · published 28 March 2018

CVE-2018-0156: Cisco IOS Smart Install packet validation flaw causes device reload

Cisco · Ios

Cisco IOS and IOS XE Smart Install client switches fail to properly validate packet data received on TCP port 4786. An unauthenticated remote attacker can send a crafted packet that triggers a reload of the affected device, causing a denial of service. Only Smart Install client switches are affected; director-configured devices are not.

7.5 CVSS 3.1 High CISA KEV since 3 Mar 2022 EPSS 8.6% · top 5.1% CWE-399 · CWE-399CWE-20 · Improper input validation
7.5CVSS 3.1 base score, v2 7.8
8.6%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
2Affected product versions listed by NVD
11References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, causes a full device reload, and is listed in CISA KEV as exploited in the wild, though impact is limited to availability.

What it is

Cisco IOS and IOS XE Smart Install client switches fail to properly validate packet data received on TCP port 4786. An unauthenticated remote attacker can send a crafted packet that triggers a reload of the affected device, causing a denial of service. Only Smart Install client switches are affected; director-configured devices are not.

Impact

The attacker can force an affected switch to reload, disrupting network availability for the duration of the outage. There is no confidentiality or integrity impact; the effect is purely denial of service.

Attack surface

Reachable over the network via TCP port 4786 with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Only devices acting as Smart Install clients are exposed.

Exploitation

CVE-2018-0156 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating exploitation in the wild. EPSS gives a 30-day probability of 0.08599 (94.8th percentile), and no ransomware campaign use is documented.

What to do

  • Apply the Cisco updates referenced in the vendor advisory cisco-sa-20180328-smi; this is the required KEV action.
  • If Smart Install is not needed, disable it on client switches.
  • Block or restrict TCP port 4786 at network boundaries so only trusted management hosts can reach Smart Install clients.
  • Identify any remaining Smart Install client switches and confirm none are director-configured, since directors are not affected.
  • Track remediation against the CISA KEV due date of 2022-03-17 for any still-unpatched devices.

Detection

  • Monitor for unexpected inbound connections or traffic to TCP port 4786 on Smart Install client switches.
  • Alert on device reload or unexpected restart events on Cisco IOS/IOS XE switches and correlate with port 4786 activity.
  • Review network telemetry for crafted or malformed packets directed at Smart Install clients from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2018-0156 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 March 2022.

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/103569 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040596 Third Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 Third Party AdvisoryUS Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 Third Party AdvisoryUS Government Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi Vendor Advisory
http://www.securityfocus.com/bid/103569 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040596 Third Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 Third Party AdvisoryUS Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 Third Party AdvisoryUS Government Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0156 US Government Resource

Track CVE-2018-0156 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2023-20198Cisco IOS XE Web UI unauthenticated privilege escalation and implant deploymentCVE-2023-20198 is a critical flaw in the Cisco IOS XE web UI that lets an unauthenticated remote attacker gain initial access and create a local priv…KEVEPSS 100%analysed9.8CVE-2018-0171Cisco IOS Smart Install improper input validation allows remote code executionCisco IOS and IOS XE Smart Install fails to properly validate packet data, so a crafted Smart Install message sent to TCP port 4786 can overflow a bu…KEVEPSS 99%analysed9.8CVE-2018-0151Cisco IOS/IOS XE QoS UDP Port 18999 Buffer OverflowCisco IOS and IOS XE contain a buffer overflow in the QoS subsystem caused by incorrect bounds checking of values in packets sent to UDP port 18999. …KEVEPSS 14%analysed9.8CVE-2017-12240Cisco IOS and IOS XE DHCP Relay Buffer Overflow RCEThe DHCP relay subsystem in Cisco IOS 12.2 through 15.6 and Cisco IOS XE contains a buffer overflow caused by improper input validation of DHCPv4 pac…KEVEPSS 14%analysed9.8CVE-2017-3881Cisco IOS/IOS XE CMP Telnet Option Handling RCECisco IOS and IOS XE fail to restrict CMP-specific Telnet options to internal cluster communications and mishandle malformed CMP Telnet options, so a…KEVEPSS 99%analysed8.8CVE-2018-0167Cisco IOS, IOS XE and IOS XR LLDP buffer overflowMultiple buffer overflow flaws exist in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS, IOS XE and IOS XR Software. An unauthenticat…KEVEPSS 3.4%analysed8.8CVE-2017-6736Cisco IOS and IOS XE SNMP buffer overflow remote code executionThe SNMP subsystem in Cisco IOS and IOS XE contains a buffer overflow that can be triggered by a crafted SNMP packet sent over IPv4 or IPv6. It affec…KEVEPSS 70%analysed8.8CVE-2017-6737Cisco IOS and IOS XE SNMP Buffer Overflow RCECisco IOS and IOS XE contain a buffer overflow in the SNMP implementation that affects SNMPv1, v2c, and v3. An authenticated remote attacker who know…KEVEPSS 45%analysed

Source: NIST National Vulnerability Database (record CVE-2018-0156), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.