{"id":"CVE-2018-0171","published":"2018-03-28T22:29:01Z","modified":"2026-06-17T01:29:59Z","title":"Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability","vendor":"Cisco","product":"IOS and IOS XE","tier":"core","eol":null,"description":{"text":"A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is in the Smart Install feature of Cisco IOS and IOS XE Software, caused by improper validation of packet data. An unauthenticated remote attacker who can reach the device on TCP port 4786 can send a crafted Smart Install message that causes a buffer overflow, leading to either a device reload (denial of service) or arbitrary code execution, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:43Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99479,"percentile":0.99944,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-0171","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-11-03","exploitedFirstSeen":"2021-11-03","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://cisa.gov/news-events/alerts/2022/04/27/2021-top-routinely-exploited-vulnerabilities","date":"2022-04-28"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-117a","date":"2022-04-28"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-158a","date":"2022-06-07"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-158a","date":"2022-06-10"},{"url":"https://securityaffairs.co/wordpress/139821/security/cisco-old-vulnerabilities-exploitation.html","date":"2022-12-19"},{"url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","date":"2025-02-20"},{"url":"https://www.greynoise.io/blog/greynoise-observes-active-exploitation-of-cisco-vulnerabilities-tied-to-salt-typhoon-attacks","date":"2025-02-24"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-How-Resurgent-Vulnerabilities-Jeopardize-Organizational-Security-Report.pdf","date":"2025-04-23"},{"url":"https://github.com/qbit6634/Indian-Telecom-Threat-Report","date":"2025-05-16"}],"evidenceTotal":32,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://www.securityfocus.com/bid/103538","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040580","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2","tags":["Vendor Advisory"]},{"url":"https://www.darkreading.com/perimeter/attackers-exploit-cisco-switch-issue-as-vendor-warns-of-yet-another-critical-flaw/d/d-id/1331490","tags":["Press/Media Coverage"]},{"url":"http://www.securityfocus.com/bid/103538","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040580","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2","tags":["Vendor Advisory"]},{"url":"https://www.darkreading.com/perimeter/attackers-exploit-cisco-switch-issue-as-vendor-warns-of-yet-another-critical-flaw/d/d-id/1331490","tags":["Press/Media Coverage"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0171","tags":["US Government Resource"]}],"techniques":[{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploitation via crafted network message","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786","start":350,"end":476}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution on device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Allowing the attacker to execute arbitrary code on the device","start":650,"end":711}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Reload causes denial of service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Triggering a reload of the device","start":615,"end":648}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-d6831d4223ab36771b1a","title":"Weathering the storm: In the midst of a Typhoon","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","date":"2025-02-20","mentions":[{"quote":"There was only one case in which we found evidence suggesting that a Cisco vulnerability (CVE-2018-0171) was likely abused.","start":718,"end":841},{"quote":"CVE-2018-0171 - Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (Last Updated: 15-Dec-2022)","start":2220,"end":2343},{"quote":"During this investigation, we also observed additional pervasive targeting of Cisco devices with exposed Smart Install (SMI) and the subsequent abuse of CVE-2018-0171, a vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE software.","start":15335,"end":15587},{"quote":"Legacy devices with known vulnerabilities, such as Smart Install (CVE-2018-0171), should be patched or decommissioned if no longer in use.","start":15836,"end":15974}]},{"id":"SRC-8d5517bedbda024608fa","title":"Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a","date":null,"mentions":[{"quote":"CVE-2018-0171 - Cisco IOS and IOS XE smart install remote code execution vulnerability","start":10747,"end":10833},{"quote":"CVE-2018-0171","start":84978,"end":84991}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-0994","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0994","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":44451,"url":"https://www.exploit-db.com/exploits/44451","title":"Cisco Smart Install - Crash (PoC)","type":"dos","platform":"hardware","date":"2018-03-29","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-03-29"},"pocGithub":{"count":1,"skipped":0,"earliest":"2023-02-01","earliestUrl":"https://github.com/AlrikRr/Cisco-Smart-Exploit","repos":[{"name":"AlrikRr/Cisco-Smart-Exploit","url":"https://github.com/AlrikRr/Cisco-Smart-Exploit","stars":18,"created":"2023-02-01"}]},"nuclei":[{"id":"CVE-2018-0171","name":"Cisco Smart Install - Configuration Download","severity":"critical","path":"javascript/cves/2018/CVE-2018-0171.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2018/CVE-2018-0171.yaml"}],"first":{"date":"2018-03-29","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/44451"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1210"],"provenance":"ai"},{"stage":"primary","techniques":["T1059","T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2018-03-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0171","provenance":"source"},{"date":"2018-03-29","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-44451); later: PoC-in-GitHub 2023-02-01","url":"https://www.exploit-db.com/exploits/44451","provenance":"source"},{"date":"2021-11-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0994","provenance":"source"},{"date":"2025-02-20","kind":"report","label":"Named in blog.talosintelligence.com: Weathering the storm: In the midst of a Typhoon","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/","provenance":"machine"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"Exploit-DB","daysToKev":1316},"priority":{"score":76.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1821 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-cisco-ios-and-ios-xe-cwe-20"}}