CVE-2018-0156: Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability

Published Mar 28, 2018

Updated

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

Other sources

— CISA

Affected Software

450 affected components

Cisco IOS Software and Cisco IOS XE Software

All of the following

Any of the following

Cisco IOS=15.2\(2\)e4

Cisco IOS=15.2\(2a\)ja

Any of the following

Cisco Catalyst 2960-plus 24lc-l

Cisco Catalyst 2960-plus 24lc-s

Cisco Catalyst 2960-plus 24pc-l

Cisco Catalyst 2960-plus 24pc-s

Cisco Catalyst 2960-plus 24tc-l

Cisco Catalyst 2960-plus 24tc-s

Cisco Catalyst 2960-plus 48pst-l

Cisco Catalyst 2960-plus 48pst-s

Cisco Catalyst 2960-plus 48tc-l

Cisco Catalyst 2960-plus 48tc-s

Cisco Catalyst 2960c-12pc-l

Cisco Catalyst 2960c-8pc-l

Cisco Catalyst 2960c-8tc-l

Cisco Catalyst 2960c-8tc-s

Cisco Catalyst 2960cg-8tc-l

Cisco Catalyst 2960cpd-8pt-l

Cisco Catalyst 2960cpd-8tt-l

Cisco Catalyst 2960s-24pd-l

Cisco Catalyst 2960s-24ps-l

Cisco Catalyst 2960s-24td-l

Cisco Catalyst 2960s-24ts-l

Cisco Catalyst 2960s-24ts-s

Cisco Catalyst 2960s-48fpd-l

Cisco Catalyst 2960s-48fps-l

Cisco Catalyst 2960s-48lpd-l

Cisco Catalyst 2960s-48lps-l

Cisco Catalyst 2960s-48td-l

Cisco Catalyst 2960s-48ts-l

Cisco Catalyst 2960s-48ts-s

Cisco Catalyst 2960s-f24ps-l

Cisco Catalyst 2960s-f24ts-l

Cisco Catalyst 2960s-f24ts-s

Cisco Catalyst 2960s-f48fps-l

Cisco Catalyst 2960s-f48lps-l

Cisco Catalyst 2960s-f48ts-l

Cisco Catalyst 2960s-f48ts-s

Cisco Catalyst 2960x-24pd-l

Cisco Catalyst 2960x-24ps-l

Cisco Catalyst 2960x-24psq-l Cool

Cisco Catalyst 2960x-24td-l

Cisco Catalyst 2960x-24ts-l

Cisco Catalyst 2960x-24ts-ll

Cisco Catalyst 2960x-48fpd-l

Cisco Catalyst 2960x-48fps-l

Cisco Catalyst 2960x-48lpd-l

Cisco Catalyst 2960x-48lps-l

Cisco Catalyst 2960x-48td-l

Cisco Catalyst 2960x-48ts-l

Cisco Catalyst 2960x-48ts-ll

Cisco Catalyst 2960xr-24pd-i

Cisco Catalyst 2960xr-24ps-i

Cisco Catalyst 2960xr-24td-i

Cisco Catalyst 2960xr-24ts-i

Cisco Catalyst 2960xr-48fpd-i

Cisco Catalyst 2960xr-48fps-i

Cisco Catalyst 2960xr-48lpd-i

Cisco Catalyst 2960xr-48lps-i

Cisco Catalyst 2960xr-48td-i

Cisco Catalyst 2960xr-48ts-i

Cisco Catalyst 3560c-12pc-s

Cisco Catalyst 3560c-8pc-s

Cisco Catalyst 3560cg-8pc-s

Cisco Catalyst 3560cg-8tc-s

Cisco Catalyst 3560cpd-8pt-s

Cisco Catalyst 3560x-24p-e

Cisco Catalyst 3560x-24p-l

Cisco Catalyst 3560x-24p-s

Cisco Catalyst 3560x-24t-e

Cisco Catalyst 3560x-24t-l

Cisco Catalyst 3560x-24t-s

Cisco Catalyst 3560x-24u-e

Cisco Catalyst 3560x-24u-l

Cisco Catalyst 3560x-24u-s

Cisco Catalyst 3560x-48p-e

Cisco Catalyst 3560x-48p-l

Cisco Catalyst 3560x-48p-s

Cisco Catalyst 3560x-48pf-e

Cisco Catalyst 3560x-48pf-l

Cisco Catalyst 3560x-48pf-s

Cisco Catalyst 3560x-48t-e

Cisco Catalyst 3560x-48t-l

Cisco Catalyst 3560x-48t-s

Cisco Catalyst 3560x-48u-e

Cisco Catalyst 3560x-48u-l

Cisco Catalyst 3560x-48u-s

Cisco Catalyst 3750x-12s-e

Cisco Catalyst 3750x-12s-s

Cisco Catalyst 3750x-24p-e

Cisco Catalyst 3750x-24p-l

Cisco Catalyst 3750x-24p-s

Cisco Catalyst 3750x-24s-e

Cisco Catalyst 3750x-24s-s

Cisco Catalyst 3750x-24t-e

Cisco Catalyst 3750x-24t-l

Cisco Catalyst 3750x-24t-s

Cisco Catalyst 3750x-24u-e

Cisco Catalyst 3750x-24u-l

Cisco Catalyst 3750x-24u-s

Cisco Catalyst 3750x-48p-e

Cisco Catalyst 3750x-48p-l

Cisco Catalyst 3750x-48p-s

Cisco Catalyst 3750x-48pf-e

Cisco Catalyst 3750x-48pf-l

Cisco Catalyst 3750x-48pf-s

Cisco Catalyst 3750x-48t-e

Cisco Catalyst 3750x-48t-l

Cisco Catalyst 3750x-48t-s

Cisco Catalyst 3750x-48u-e

Cisco Catalyst 3750x-48u-l

Cisco Catalyst 3750x-48u-s

Cisco Catalyst 4500 Supervisor Engine 6-e

Cisco Catalyst 4500 Supervisor Engine 6l-e

Cisco Catalyst 4900m

Cisco Catalyst 4948e

Cisco Catalyst 4948e-f

Cisco Embedded Service 2020 24tc Con

Cisco Embedded Service 2020 24tc Con B

Cisco Embedded Service 2020 24tc Ncp

Cisco Embedded Service 2020 24tc Ncp B

Cisco Embedded Service 2020 Con

Cisco Embedded Service 2020 Con B

Cisco Embedded Service 2020 Ncp

Cisco Embedded Service 2020 Ncp B

Cisco Ie-3010-16s-8pc

Cisco Ie-3010-24tc

Cisco Ie 2000-16ptc-g

Cisco Ie 2000-16t67

Cisco Ie 2000-16t67p

Cisco Ie 2000-16tc

Cisco Ie 2000-16tc-g

Cisco Ie 2000-16tc-g-e

Cisco Ie 2000-16tc-g-n

Cisco Ie 2000-16tc-g-x

Cisco Ie 2000-24t67

Cisco Ie 2000-4s-ts-g

Cisco Ie 2000-4t

Cisco Ie 2000-4t-g

Cisco Ie 2000-4ts

Cisco Ie 2000-4ts-g

Cisco Ie 2000-8t67

Cisco Ie 2000-8t67p

Cisco Ie 2000-8tc

Cisco Ie 2000-8tc-g

Cisco Ie 2000-8tc-g-e

Cisco Ie 2000-8tc-g-n

Cisco Ie 3000-4tc

Cisco Ie 3000-8tc

All of the following

Any of the following

Cisco IOS XE=15.2\(2\)e4

Cisco IOS XE=15.2\(2a\)ja

Any of the following

Cisco Catalyst 2960-plus 24lc-l

Cisco Catalyst 2960-plus 24lc-s

Cisco Catalyst 2960-plus 24pc-l

Cisco Catalyst 2960-plus 24pc-s

Cisco Catalyst 2960-plus 24tc-l

Cisco Catalyst 2960-plus 24tc-s

Cisco Catalyst 2960-plus 48pst-l

Cisco Catalyst 2960-plus 48pst-s

Cisco Catalyst 2960-plus 48tc-l

Cisco Catalyst 2960-plus 48tc-s

Cisco Catalyst 2960c-12pc-l

Cisco Catalyst 2960c-8pc-l

Cisco Catalyst 2960c-8tc-l

Cisco Catalyst 2960c-8tc-s

Cisco Catalyst 2960cg-8tc-l

Cisco Catalyst 2960cpd-8pt-l

Cisco Catalyst 2960cpd-8tt-l

Cisco Catalyst 2960s-24pd-l

Cisco Catalyst 2960s-24ps-l

Cisco Catalyst 2960s-24td-l

Cisco Catalyst 2960s-24ts-l

Cisco Catalyst 2960s-24ts-s

Cisco Catalyst 2960s-48fpd-l

Cisco Catalyst 2960s-48fps-l

Cisco Catalyst 2960s-48lpd-l

Cisco Catalyst 2960s-48lps-l

Cisco Catalyst 2960s-48td-l

Cisco Catalyst 2960s-48ts-l

Cisco Catalyst 2960s-48ts-s

Cisco Catalyst 2960s-f24ps-l

Cisco Catalyst 2960s-f24ts-l

Cisco Catalyst 2960s-f24ts-s

Cisco Catalyst 2960s-f48fps-l

Cisco Catalyst 2960s-f48lps-l

Cisco Catalyst 2960s-f48ts-l

Cisco Catalyst 2960s-f48ts-s

Cisco Catalyst 2960x-24pd-l

Cisco Catalyst 2960x-24ps-l

Cisco Catalyst 2960x-24psq-l Cool

Cisco Catalyst 2960x-24td-l

Cisco Catalyst 2960x-24ts-l

Cisco Catalyst 2960x-24ts-ll

Cisco Catalyst 2960x-48fpd-l

Cisco Catalyst 2960x-48fps-l

Cisco Catalyst 2960x-48lpd-l

Cisco Catalyst 2960x-48lps-l

Cisco Catalyst 2960x-48td-l

Cisco Catalyst 2960x-48ts-l

Cisco Catalyst 2960x-48ts-ll

Cisco Catalyst 2960xr-24pd-i

Cisco Catalyst 2960xr-24ps-i

Cisco Catalyst 2960xr-24td-i

Cisco Catalyst 2960xr-24ts-i

Cisco Catalyst 2960xr-48fpd-i

Cisco Catalyst 2960xr-48fps-i

Cisco Catalyst 2960xr-48lpd-i

Cisco Catalyst 2960xr-48lps-i

Cisco Catalyst 2960xr-48td-i

Cisco Catalyst 2960xr-48ts-i

Cisco Catalyst 3560c-12pc-s

Cisco Catalyst 3560c-8pc-s

Cisco Catalyst 3560cg-8pc-s

Cisco Catalyst 3560cg-8tc-s

Cisco Catalyst 3560cpd-8pt-s

Cisco Catalyst 3560x-24p-e

Cisco Catalyst 3560x-24p-l

Cisco Catalyst 3560x-24p-s

Cisco Catalyst 3560x-24t-e

Cisco Catalyst 3560x-24t-l

Cisco Catalyst 3560x-24t-s

Cisco Catalyst 3560x-24u-e

Cisco Catalyst 3560x-24u-l

Cisco Catalyst 3560x-24u-s

Cisco Catalyst 3560x-48p-e

Cisco Catalyst 3560x-48p-l

Cisco Catalyst 3560x-48p-s

Cisco Catalyst 3560x-48pf-e

Cisco Catalyst 3560x-48pf-l

Cisco Catalyst 3560x-48pf-s

Cisco Catalyst 3560x-48t-e

Cisco Catalyst 3560x-48t-l

Cisco Catalyst 3560x-48t-s

Cisco Catalyst 3560x-48u-e

Cisco Catalyst 3560x-48u-l

Cisco Catalyst 3560x-48u-s

Cisco Catalyst 3750x-12s-e

Cisco Catalyst 3750x-12s-s

Cisco Catalyst 3750x-24p-e

Cisco Catalyst 3750x-24p-l

Cisco Catalyst 3750x-24p-s

Cisco Catalyst 3750x-24s-e

Cisco Catalyst 3750x-24s-s

Cisco Catalyst 3750x-24t-e

Cisco Catalyst 3750x-24t-l

Cisco Catalyst 3750x-24t-s

Cisco Catalyst 3750x-24u-e

Cisco Catalyst 3750x-24u-l

Cisco Catalyst 3750x-24u-s

Cisco Catalyst 3750x-48p-e

Cisco Catalyst 3750x-48p-l

Cisco Catalyst 3750x-48p-s

Cisco Catalyst 3750x-48pf-e

Cisco Catalyst 3750x-48pf-l

Cisco Catalyst 3750x-48pf-s

Cisco Catalyst 3750x-48t-e

Cisco Catalyst 3750x-48t-l

Cisco Catalyst 3750x-48t-s

Cisco Catalyst 3750x-48u-e

Cisco Catalyst 3750x-48u-l

Cisco Catalyst 3750x-48u-s

Cisco Catalyst 4500 Supervisor Engine 6-e

Cisco Catalyst 4500 Supervisor Engine 6l-e

Cisco Catalyst 4900m

Cisco Catalyst 4948e

Cisco Catalyst 4948e-f

Cisco Embedded Service 2020 24tc Con

Cisco Embedded Service 2020 24tc Con B

Cisco Embedded Service 2020 24tc Ncp

Cisco Embedded Service 2020 24tc Ncp B

Cisco Embedded Service 2020 Con

Cisco Embedded Service 2020 Con B

Cisco Embedded Service 2020 Ncp

Cisco Embedded Service 2020 Ncp B

Cisco Ie-3010-16s-8pc

Cisco Ie-3010-24tc

Cisco Ie 2000-16ptc-g

Cisco Ie 2000-16t67

Cisco Ie 2000-16t67p

Cisco Ie 2000-16tc

Cisco Ie 2000-16tc-g

Cisco Ie 2000-16tc-g-e

Cisco Ie 2000-16tc-g-n

Cisco Ie 2000-16tc-g-x

Cisco Ie 2000-24t67

Cisco Ie 2000-4s-ts-g

Cisco Ie 2000-4t

Cisco Ie 2000-4t-g

Cisco Ie 2000-4ts

Cisco Ie 2000-4ts-g

Cisco Ie 2000-8t67

Cisco Ie 2000-8t67p

Cisco Ie 2000-8tc

Cisco Ie 2000-8tc-g

Cisco Ie 2000-8tc-g-e

Cisco Ie 2000-8tc-g-n

Cisco Ie 3000-4tc

Cisco Ie 3000-8tc

Cisco IOS=15.2\(2\)e4

Cisco IOS=15.2\(2a\)ja

Cisco Catalyst 2960-plus 24lc-l

Cisco Catalyst 2960-plus 24lc-s

Cisco Catalyst 2960-plus 24pc-l

Cisco Catalyst 2960-plus 24pc-s

Cisco Catalyst 2960-plus 24tc-l

Cisco Catalyst 2960-plus 24tc-s

Cisco Catalyst 2960-plus 48pst-l

Cisco Catalyst 2960-plus 48pst-s

Cisco Catalyst 2960-plus 48tc-l

Cisco Catalyst 2960-plus 48tc-s

Cisco Catalyst 2960c-12pc-l

Cisco Catalyst 2960c-8pc-l

Cisco Catalyst 2960c-8tc-l

Cisco Catalyst 2960c-8tc-s

Cisco Catalyst 2960cg-8tc-l

Cisco Catalyst 2960cpd-8pt-l

Cisco Catalyst 2960cpd-8tt-l

Cisco Catalyst 2960s-24pd-l

Cisco Catalyst 2960s-24ps-l

Cisco Catalyst 2960s-24td-l

Cisco Catalyst 2960s-24ts-l

Cisco Catalyst 2960s-24ts-s

Cisco Catalyst 2960s-48fpd-l

Cisco Catalyst 2960s-48fps-l

Cisco Catalyst 2960s-48lpd-l

Cisco Catalyst 2960s-48lps-l

Cisco Catalyst 2960s-48td-l

Cisco Catalyst 2960s-48ts-l

Cisco Catalyst 2960s-48ts-s

Cisco Catalyst 2960s-f24ps-l

Cisco Catalyst 2960s-f24ts-l

Cisco Catalyst 2960s-f24ts-s

Cisco Catalyst 2960s-f48fps-l

Cisco Catalyst 2960s-f48lps-l

Cisco Catalyst 2960s-f48ts-l

Cisco Catalyst 2960s-f48ts-s

Cisco Catalyst 2960x-24pd-l

Cisco Catalyst 2960x-24ps-l

Cisco Catalyst 2960x-24psq-l Cool

Cisco Catalyst 2960x-24td-l

Cisco Catalyst 2960x-24ts-l

Cisco Catalyst 2960x-24ts-ll

Cisco Catalyst 2960x-48fpd-l

Cisco Catalyst 2960x-48fps-l

Cisco Catalyst 2960x-48lpd-l

Cisco Catalyst 2960x-48lps-l

Cisco Catalyst 2960x-48td-l

Cisco Catalyst 2960x-48ts-l

Cisco Catalyst 2960x-48ts-ll

Cisco Catalyst 2960xr-24pd-i

Cisco Catalyst 2960xr-24ps-i

Cisco Catalyst 2960xr-24td-i

Cisco Catalyst 2960xr-24ts-i

Cisco Catalyst 2960xr-48fpd-i

Cisco Catalyst 2960xr-48fps-i

Cisco Catalyst 2960xr-48lpd-i

Cisco Catalyst 2960xr-48lps-i

Cisco Catalyst 2960xr-48td-i

Cisco Catalyst 2960xr-48ts-i

Cisco Catalyst 3560c-12pc-s

Cisco Catalyst 3560c-8pc-s

Cisco Catalyst 3560cg-8pc-s

Cisco Catalyst 3560cg-8tc-s

Cisco Catalyst 3560cpd-8pt-s

Cisco Catalyst 3560x-24p-e

Cisco Catalyst 3560x-24p-l

Cisco Catalyst 3560x-24p-s

Cisco Catalyst 3560x-24t-e

Cisco Catalyst 3560x-24t-l

Cisco Catalyst 3560x-24t-s

Cisco Catalyst 3560x-24u-e

Cisco Catalyst 3560x-24u-l

Cisco Catalyst 3560x-24u-s

Cisco Catalyst 3560x-48p-e

Cisco Catalyst 3560x-48p-l

Cisco Catalyst 3560x-48p-s

Cisco Catalyst 3560x-48pf-e

Cisco Catalyst 3560x-48pf-l

Cisco Catalyst 3560x-48pf-s

Cisco Catalyst 3560x-48t-e

Cisco Catalyst 3560x-48t-l

Cisco Catalyst 3560x-48t-s

Cisco Catalyst 3560x-48u-e

Cisco Catalyst 3560x-48u-l

Cisco Catalyst 3560x-48u-s

Cisco Catalyst 3750x-12s-e

Cisco Catalyst 3750x-12s-s

Cisco Catalyst 3750x-24p-e

Cisco Catalyst 3750x-24p-l

Cisco Catalyst 3750x-24p-s

Cisco Catalyst 3750x-24s-e

Cisco Catalyst 3750x-24s-s

Cisco Catalyst 3750x-24t-e

Cisco Catalyst 3750x-24t-l

Cisco Catalyst 3750x-24t-s

Cisco Catalyst 3750x-24u-e

Cisco Catalyst 3750x-24u-l

Cisco Catalyst 3750x-24u-s

Cisco Catalyst 3750x-48p-e

Cisco Catalyst 3750x-48p-l

Cisco Catalyst 3750x-48p-s

Cisco Catalyst 3750x-48pf-e

Cisco Catalyst 3750x-48pf-l

Cisco Catalyst 3750x-48pf-s

Cisco Catalyst 3750x-48t-e

Cisco Catalyst 3750x-48t-l

Cisco Catalyst 3750x-48t-s

Cisco Catalyst 3750x-48u-e

Cisco Catalyst 3750x-48u-l

Cisco Catalyst 3750x-48u-s

Cisco Catalyst 4500 Supervisor Engine 6-e

Cisco Catalyst 4500 Supervisor Engine 6l-e

Cisco Catalyst 4900m

Cisco Catalyst 4948e

Cisco Catalyst 4948e-f

Cisco Embedded Service 2020 24tc Con

Cisco Embedded Service 2020 24tc Con B

Cisco Embedded Service 2020 24tc Ncp

Cisco Embedded Service 2020 24tc Ncp B

Cisco Embedded Service 2020 Con

Cisco Embedded Service 2020 Con B

Cisco Embedded Service 2020 Ncp

Cisco Embedded Service 2020 Ncp B

Cisco Ie-3010-16s-8pc

Cisco Ie-3010-24tc

Cisco Ie 2000-16ptc-g

Cisco Ie 2000-16t67

Cisco Ie 2000-16t67p

Cisco Ie 2000-16tc

Cisco Ie 2000-16tc-g

Cisco Ie 2000-16tc-g-e

Cisco Ie 2000-16tc-g-n

Cisco Ie 2000-16tc-g-x

Cisco Ie 2000-24t67

Cisco Ie 2000-4s-ts-g

Cisco Ie 2000-4t

Cisco Ie 2000-4t-g

Cisco Ie 2000-4ts

Cisco Ie 2000-4ts-g

Cisco Ie 2000-8t67

Cisco Ie 2000-8t67p

Cisco Ie 2000-8tc

Cisco Ie 2000-8tc-g

Cisco Ie 2000-8tc-g-e

Cisco Ie 2000-8tc-g-n

Cisco Ie 3000-4tc

Cisco Ie 3000-8tc

Cisco IOS XE=15.2\(2\)e4

Cisco IOS XE=15.2\(2a\)ja

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable the Smart Install feature on switches configured as Smart Install clients to prevent processing of crafted packets targeting the Smart Install protocol.
Cisco IOS / IOS XE Smart Install (client switches) Smart Install feature = disabled
Compensating control
Block TCP port 4786 (Smart Install) at network boundaries and enforce ACLs/firewall rules to prevent untrusted hosts from sending traffic to Cisco devices on TCP port 4786.
Operational
Identify and inventory devices configured as Smart Install clients (only Smart Install client switches are affected); verify whether the Smart Install feature is enabled on those devices and remediate (disable) as appropriate.

Event History

Mar 28, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Data Sourced

via NVD·10:29 PM

DescriptionSeverityWeaknessAffected Software

Mar 3, 2022

Known Exploited

via CISA·12:00 AM

Frequently Asked Questions

What is the severity of CVE-2018-0156?

CVE-2018-0156 is rated critical, as it can lead to a denial of service (DoS) condition.

How do I fix CVE-2018-0156?

Fix CVE-2018-0156 by applying the updated software versions provided by Cisco as per their advisory.

Which Cisco products are affected by CVE-2018-0156?

CVE-2018-0156 affects various versions of Cisco IOS and IOS XE software, specifically those running version 15.2(2)e4 and 15.2(2a)ja.

What type of attack can exploit CVE-2018-0156?

CVE-2018-0156 can be exploited by unauthenticated, remote attackers to initiate a device reload.

What is the impact of CVE-2018-0156 on my network devices?

The impact of CVE-2018-0156 is significant as it results in a denial of service, causing the affected Cisco devices to reload.

CVE-2018-0156: Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability

Other sources

Affected Software

Remediation

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2018-0156?

How do I fix CVE-2018-0156?

Which Cisco products are affected by CVE-2018-0156?

What type of attack can exploit CVE-2018-0156?

What is the impact of CVE-2018-0156 on my network devices?

Company

Resources

Contact