Cisco · IOS and IOS XE
The flaw is in the Smart Install feature of Cisco IOS and IOS XE Software, caused by improper validation of packet data. An unauthenticated remote attacker who can reach the device on TCP port 4786 can send a crafted Smart Install message that causes a buffer overflow, leading to either a device reload (denial of service) or arbitrary code execution, with no user interaction required.
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.
First seen exploited 4 years after disclosure. Public exploit code (Exploit-DB) appeared 1 day after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Arbitrary code execution on device
Allowing the attacker to execute arbitrary code on the device
Remote exploitation via crafted network message
An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786
Reload causes denial of service
Triggering a reload of the device
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2018-0171 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
During this investigation, we also observed additional pervasive targeting of Cisco devices with exposed Smart Install (SMI) and the subsequent abuse of CVE-2018-0171, a vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE software.
4 passages name itOriginal (opens in a new tab) ↗
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.