CVE-2018-0167: Cisco IOS, IOS XE and IOS XR LLDP buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is remotely triggerable without authentication from an adjacent network, rated CVSS 8.8, and is in CISA's KEV catalog, though exploitation requires Layer 2 adjacency and no public exploit detail is given in the record.

What it is

Multiple buffer overflow flaws exist in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS, IOS XE and IOS XR Software. An unauthenticated attacker on the same Layer 2 segment can trigger memory corruption, causing a denial of service or potentially code execution with elevated privileges. The record does not list specific affected releases or fixed versions, so those must be confirmed against the Cisco advisory.

Impact

An attacker gains the ability to crash or reload the affected device, and in the worst case execute arbitrary code with elevated privileges on it. Because the flaw sits in a network infrastructure component, a successful exploit can disrupt or take over routing and switching functions.

Attack surface

Reachable over the adjacent network via LLDP frames, per the CVSS vector AV:A/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. The attacker only needs Layer 2 adjacency to a device running a vulnerable LLDP implementation.

Exploitation

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating real-world exploitation, though the record does not document ransomware use. EPSS gives a 30-day exploitation probability of about 3.4 percent (88th percentile), and no reference is tagged as an exploit or proof-of-concept.

What to do

• Apply the Cisco IOS, IOS XE and IOS XR updates referenced in Cisco advisory cisco-sa-20180328-lldp, prioritizing internet- and edge-facing devices.
• If LLDP is not required, disable it on affected interfaces to remove the attack surface.
• Restrict Layer 2 adjacency on access ports (port security, 802.1X, disabling unused ports) to limit who can send LLDP frames.
• Segment management and access networks so untrusted hosts cannot reach LLDP-speaking infrastructure directly.
• Track CISA KEV remediation due dates and verify patched versions after upgrade.

Detection

• Monitor device logs and syslog for unexpected reloads, crashes or LLDP-related tracebacks on Cisco IOS, IOS XE and IOS XR devices.
• Watch for LLDP frames with malformed or oversized TLVs on access and inter-switch links using switch or IDS/IPS telemetry.
• Alert on new or unexpected LLDP neighbors appearing on access ports, which may indicate an attacker on the segment.
• Correlate device uptime resets and interface flaps with LLDP traffic bursts to spot exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.