CVE-2018-0174: Cisco IOS and IOS XE DHCP option 82 input validation DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, causes full device reload, and is listed in CISA KEV as exploited in the wild.

What it is

Cisco IOS and IOS XE Software perform incomplete input validation of DHCP option 82 information received in DHCPv4 packets from relay agents. A crafted DHCPv4 packet can cause the affected device to reload, producing a denial of service. The flaw is remotely reachable without authentication, so any device processing such packets is exposed.

Impact

An attacker can force an affected device to reload, causing a denial of service. There is no reported confidentiality or integrity impact; the effect is availability loss on the device.

Attack surface

Reached over the network by sending a crafted DHCPv4 packet containing option 82 information to an affected device. The CVSS vector shows no privileges and no user interaction required, so it is unauthenticated and remote.

Exploitation

CVE-2018-0174 is listed in CISA's Known Exploited Vulnerabilities catalog, indicating known exploitation in the wild. EPSS gives a 30-day probability of about 7.6 percent (94th percentile), and references are vendor, CERT and third-party advisories rather than public exploit code.

What to do

• Apply the Cisco updates referenced in the vendor advisory cisco-sa-20180328-dhcpr3 as the primary fix.
• Follow CISA KEV required action to apply vendor updates within the stated remediation window.
• Restrict DHCP relay traffic and option 82 handling to trusted relay agents at network boundaries where feasible.
• Monitor affected IOS and IOS XE devices for unexpected reloads and correlate with DHCP traffic.
• Review exposure of management and relay-facing interfaces that accept DHCPv4 packets.

Detection

• Alert on unexpected device reloads or crash/restart events on Cisco IOS and IOS XE devices.
• Inspect DHCPv4 traffic for malformed or unusual option 82 content arriving from relay agents.
• Correlate spikes in DHCPv4 packets with device restart logs to identify attempted exploitation.
• Review syslog and SNMP traps for reload or watchdog events on affected platforms.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.