CVE-2018-0156
Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability
Published Mar 28, 2018 · updated Jun 16, 2026 · cisco ios
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.
Timeline
Detection, updates, and resolution for this record.
Mar 28, 2018 · Catalog
Detected
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP
Mar 3, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 17, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP
Required action
Apply updates per vendor instructions.
CISA due date Mar 17, 2022
Affected
- cpe cisco/ios15.2\(2\)e4
- cpe cisco/ios15.2\(2a\)ja
- cpe cisco/ios xe15.2\(2\)e4
- cpe cisco/ios xe15.2\(2a\)ja
- vendor Cisco IOS Software and Cisco IOS XE Softwareversion unspecified
Sources
- CISA KEVCVE-2018-0156
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.
cisa.gov - CVE.orgCVE-2018-0156
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-0156
30-day exploitation probability 9.4%
first.org - NIST NVDCVE-2018-0156
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validatio
nvd.nist.gov