CVE-2018-0173: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvg62754.
Other sources
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If DHCP relay/forwarding is not required on the device, disable it. If it is required, restrict DHCP relay/forwarding to only trusted interfaces or VLANs to prevent untrusted hosts from causing the device to forward crafted DHCPv4 packets.
Cisco IOS / IOS XE DHCP relay/forwarding = disabled or restricted to trusted interfaces - Compensating control
Implement network-level filtering to block or restrict DHCPv4 traffic from untrusted sources. Use ACLs, firewall rules, or port-based controls to ensure DHCP requests and DHCPOFFER responses are only accepted from known/trusted DHCP servers and relays (prevent untrusted hosts from sending DHCP packets to the affected device).
- Operational
Monitor affected devices for unexpected reloads or crashes, collect crash logs and core dumps for debugging, and track Cisco advisory/bug CSCvg62754. Apply vendor-provided updates or patches as soon as Cisco publishes a fix.
Event History
Frequently Asked Questions
What is CVE-2018-0173?
CVE-2018-0173 is a vulnerability in the Cisco IOS and IOS XE Software function that allows an unauthenticated attacker to cause a denial of service (DoS) by causing an affected device to reload.
What is the severity of CVE-2018-0173?
The severity of CVE-2018-0173 is high with a CVSS score of 8.6.
What devices are affected by CVE-2018-0173?
Cisco IOS and IOS XE Software versions denali-16.3.4 and earlier are affected by CVE-2018-0173.
How can an attacker exploit CVE-2018-0173?
An attacker can exploit CVE-2018-0173 by sending specially crafted DHCPv4 packets with encapsulated option 82 information.
Are the Cisco 4321, 4331, 4351, 4431, and 4451-x Integrated Services Routers affected by CVE-2018-0173?
No, the Cisco 4321, 4331, 4351, 4431, and 4451-x Integrated Services Routers are not vulnerable to CVE-2018-0173.