CVE-2018-0171: Cisco IOS Smart Install improper input validation allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, confirmed exploitation in CISA KEV, and near-maximum EPSS probability make this a top remediation priority.

What it is

Cisco IOS and IOS XE Smart Install fails to properly validate packet data, so a crafted Smart Install message sent to TCP port 4786 can overflow a buffer. The result is a device reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution. Because Smart Install is meant to simplify switch provisioning and is often left enabled and reachable, this is a serious exposure for network infrastructure.

Impact

An unauthenticated remote attacker can crash or reload the device, causing a denial of service, or execute arbitrary code with the privileges of the affected process, giving full control of the switch or router.

Attack surface

Reachable over the network via a crafted Smart Install message to TCP port 4786; the CVSS vector shows no privileges and no user interaction required. Any device with Smart Install enabled and port 4786 exposed is a candidate target.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, and EPSS probability is 0.99479 (percentile 0.99943), indicating observed exploitation and very high likelihood of attempted exploitation. No ransomware campaign use is documented.

What to do

• Apply the Cisco updates referenced in the vendor advisory cisco-sa-20180328-smi2 as the primary fix.
• Disable the Smart Install feature on devices that do not require it, per Cisco guidance.
• Block or restrict TCP port 4786 at network boundaries and between network segments.
• Audit for Smart Install being enabled on internet-facing or untrusted-segment devices and remediate.
• Track CISA KEV remediation deadlines for any remaining affected devices.

Detection

• Monitor network traffic for connections to TCP port 4786, especially from unexpected or external sources.
• Alert on device reloads, watchdog crashes, or unexpected reboots of Cisco IOS/IOS XE devices.
• Review Cisco device logs for Smart Install activity and anomalous configuration changes.
• Use the Cisco advisory and ICS-CERT advisories to build inventory checks for affected IOS and IOS XE versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.