CVE-2018-0161: Cisco IOS SNMP GET Request Causes Device Restart

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely triggerable with valid SNMP credentials, causes full device restart, and is listed in CISA KEV, though it requires authentication and a specific OID request.

What it is

Cisco IOS Software on certain Catalyst switches mishandles SNMP read requests for the ciscoFlashMIB object ID, causing a SYS-3-CPUHOG condition that restarts the device. The flaw is remotely reachable by an authenticated SNMPv2 or SNMPv3 user and results in a denial of service. It matters because it can repeatedly take down switch availability in environments where SNMP is enabled.

Impact

An attacker with valid SNMP credentials can force the affected switch to restart, interrupting network access for everything behind it. No data is read or modified; the gain is purely availability loss.

Attack surface

Reached over the network via SNMPv2 or SNMPv3 on devices configured for SNMP. Authentication is required (a valid SNMP community or user), and no user interaction is needed.

Exploitation

CVE-2018-0161 is listed in CISA's Known Exploited Vulnerabilities catalog, indicating observed exploitation, though the record does not describe specific campaigns. EPSS gives a 30-day probability of about 4.1 percent (90th percentile).

What to do

• Apply the Cisco IOS Software updates referenced in the Cisco security advisory cisco-sa-20180328-snmp.
• If patching cannot be done immediately, disable SNMPv2 and SNMPv3 on affected Catalyst 2960-L and Digital Building switches, or restrict SNMP access to trusted management hosts via ACLs.
• Replace SNMPv2c community strings with SNMPv3 authenticated users and avoid read access to the ciscoFlashMIB OID where possible.
• Monitor for unexpected device restarts and correlate them with SNMP GET activity for the ciscoFlashMIB OID.

Detection

• Alert on SNMP GET requests targeting the ciscoFlashMIB OID from unexpected or non-management source addresses.
• Track SYS-3-CPUHOG syslog messages and unexpected reload events on Catalyst 2960-L and Digital Building switches.
• Baseline normal SNMP polling sources and flag new or high-volume SNMPv2/v3 querying hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.