PT-2018-3804 · Cisco · Cisco Ios Xr+2

Published 2018-03-28 · Updated 2025-10-28 · CVE-2018-0175

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS Software (affected versions not specified) Cisco IOS XE Software (affected versions not specified) Cisco IOS XR Software (affected versions not specified)

Description A Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.

Recommendations For Cisco IOS Software, update to a version that addresses this vulnerability. For Cisco IOS XE Software, update to a version that addresses this vulnerability. For Cisco IOS XR Software, update to a version that addresses this vulnerability. As a temporary workaround, consider disabling the LLDP subsystem until a patch is available. Restrict access to the LLDP subsystem to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-119

CWE-134

Related Identifiers

BDU:2022-04550

CVE-2018-0175

Affected Products

Cisco Ios

Cisco Ios Xe

Cisco Ios Xr

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2018-0175 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04550 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0175 · Vendor Advisory
• http://securityfocus.com/bid/103564 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0175 · Note
• http://securitytracker.com/id/1040586 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 · Note
• https://t.me/cvenotify/108769 · Telegram Post
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 · Note
• https://t.me/cveNotify/140651 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note