CVE-2018-0171

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2018-0171 9.8

Cisco · IOS and IOS XE · Added 2021-11-03 · Published 2018-03-28

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityCisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

VendorCisco

ProductIOS and IOS XE

Date added2021-11-03

Due date2022-05-03

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-20 CWE-787

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.

NVD: A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-17 10:51 UTC

Wall time0.3s

Searches1

Component defaultyes

Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory?cve=CVE-2018-0171
https://www.splunk.com/en_us/blog/security/cve-2018-0171-static-tundra-smart-install-detection-guide.html
https://github.com/AlrikRr/Cisco-Smart-Exploit
https://gist.github.com/pich4ya/d03574b4613bff095621472367465a7e
https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2018/CVE-2018-0171.yaml
https://blogs.cisco.com/security/cisco-psirt-mitigating-and-detecting-potential-abuse-of-cisco-smart-install-feature
https://github.com/Cisco-Talos/smi_check
https://nvd.nist.gov/vuln/detail/CVE-2018-0171

Hunting hypothesis agent

Hunt firewall/NetFlow and IDS logs for unexpected TCP/4786 connections with oversized Smart Install payloads (Snort SIDs 46096/46468) plus outbound TFTP config uploads from switches; stock device logs miss the crafted packets.

Research details

ComponentSmart Install client (vstack) provisioning message handler on TCP port 4786

PreconditionsNetwork reachability to TCP port 4786 on the target device; No authentication required; Target must run a vulnerable Cisco IOS or IOS XE release with the Smart Install client feature enabled (Catalyst 2960/2960-S/2960-X/3560/3750-X/4500/6500 and others per the Cisco advisory; IOS 12.x-15.x and IOS XE before fixed releases); Smart Install client functionality is enabled by default on many switch platforms - verify with `show vstack config` (Role: Client, SmartInstall enabled) or `show tcp brief all | include 4786`; a single crafted Smart Install message can trigger the overflow, no director role or special device configuration is required. agent

Deliverynetwork_exploit

Public PoCyes

PoC URLs https://github.com/AlrikRr/Cisco-Smart-Exploit
https://gist.github.com/pich4ya/d03574b4613bff095621472367465a7e
https://github.com/Cisco-Talos/smi_check
https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2018/CVE-2018-0171.yaml Third-party repos; verify before use.

Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0); Unauthenticated TCP/4786 buffer overflow - Embedi demonstrated RCE at GeekPWN 2017; SIET (Smart Install Exploitation Tool) and Talos smi_check automate exploitation and config theft; follow-on abuse includes backdoor privilege-15 accounts, SNMP community changes, and TFTP config exfiltration; actively used by Static Tundra (FBI-attributed) and Salt Typhoon.

SummaryCVE-2018-0171 is an unauthenticated buffer overflow in the Smart Install client feature of Cisco IOS and IOS XE, exposed on TCP port 4786 and enabled by default on many Catalyst switches. A crafted Smart Install message overflows the packet handler, triggering a device reload (denial of service) or arbitrary code execution. Public exploit tooling (Embedi's GeekPWN 2017 RCE demo, SIET, Metasploit and Talos smi_check scanners) automates code execution, TFTP theft of startup/running configs, and Type-7 password extraction. APT actors including Static Tundra and Salt Typhoon have used it for persistent infrastructure access.

Tia coverage

First reported2026-07-14

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

fsb-center-16-router-targeting-campaign-13-nation-joint-advisory

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.