CVE-2018-0172: Cisco IOS and IOS XE DHCP option 82 heap overflow denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable without authentication or interaction, causes full device reload, and is listed in CISA KEV, though it is availability-only and requires DHCP option 82 traffic to reach the device.

What it is

Cisco IOS and IOS XE Software perform incomplete input validation of DHCP option 82 information received in DHCPv4 packets from relay agents. A crafted DHCPv4 packet triggers a heap overflow that causes the device to reload, producing a denial of service. Because the affected devices are network infrastructure, a successful hit removes forwarding and routing for everything behind them.

Impact

An unauthenticated, remote attacker can crash and reload an affected device, causing a denial of service. The CVSS vector shows no confidentiality or integrity impact, only availability loss, with scope change because the failure affects resources beyond the vulnerable component.

Attack surface

The flaw is reached over the network by sending a crafted DHCPv4 packet containing option 82 data to an affected device; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. The description states the option 82 information is expected from DHCP relay agents, so exposure depends on the device accepting such traffic.

Exploitation

CVE-2018-0172 is listed in CISA KEV with a due date of 2022-03-17, indicating known exploitation, and EPSS shows a 30-day probability of 0.0782 (94th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the Cisco updates referenced in the vendor advisory cisco-sa-20180328-dhcpr1, treating this as the primary action given KEV listing.
• If patching cannot be done immediately, restrict or filter DHCPv4 traffic carrying option 82 so only trusted relay agents can reach affected devices.
• Segment management and relay paths so untrusted hosts cannot inject DHCPv4 packets toward IOS/IOS XE devices.
• Track the device against the Cisco advisory and CISA KEV required action until the update is confirmed installed.

Detection

• Monitor device logs and syslog for unexpected reloads or crash traces on IOS/IOS XE devices that handle DHCP relay traffic.
• Alert on DHCPv4 packets containing option 82 arriving from sources other than known relay agents.
• Baseline normal DHCP relay traffic and flag option 82 payloads with anomalous length or content.
• Correlate device reload events with nearby DHCP traffic to distinguish this crash from other causes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.