CVE-2018-0173
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
Published Mar 28, 2018 · updated Jun 16, 2026 · cisco ios
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.
Timeline
Detection, updates, and resolution for this record.
Mar 28, 2018 · Catalog
Detected
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validatio
Mar 3, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 17, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validatio
Required action
Apply updates per vendor instructions.
CISA due date Mar 17, 2022
Affected
- cpe cisco/iosversion unspecified
- cpe cisco/iosdenali-16.3.4
- cpe cisco/ios xeversion unspecified
- cpe cisco/ios xedenali-16.3.4
- vendor Cisco IOS and IOS XE Softwareversion unspecified
Sources
- CISA KEVCVE-2018-0173
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
cisa.gov - CVE.orgCVE-2018-0173
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-0173
30-day exploitation probability 7.6%
first.org - NIST NVDCVE-2018-0173
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denia
nvd.nist.gov