Cloudanix VulnDB

CVE-2018-0155

High · 8.6 CISA KEV

CVSS

8.6

EPSS

7.7%

Published

Mar 28, 2018

CISA due date

Mar 17, 2022

Cloudanix analysis

Act now SSVC: Attend

A flaw in certain older Cisco network switches lets attackers send a specially made message that crashes the switch and knocks it offline until it restarts.

Active In The Wild
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient error handling in the BFD offload implementation allows a crafted BFD packet with an incomplete header to trigger a crash of the iosd process on affected Cisco Catalyst switches, resulting in a system reload and denial of service.

Why it matters to the business

Successful exploitation causes network switch outages that interrupt connectivity for all dependent systems and services; the issue remains actively exploited in the wild with a past CISA remediation deadline, amplifying operational risk for unpatched legacy deployments.

How an attack unfolds

An attacker sends a specially crafted BFD message containing an incomplete header to or through an affected switch; the flawed offload handling causes the iosd process to crash, forcing a reload and denying service to the device.

How to fix it

Upgrade affected Cisco Catalyst 4500 series, 4500-X, 4900M, and 4948E switches to the fixed IOS or IOS-XE releases listed in Cisco bug CSCvc40729; if immediate patching is not feasible, disable BFD offload or restrict BFD traffic via ACLs as interim mitigation.

How to confirm the fix worked

Verify device software versions against the advisory, confirm absence of the iosd crash signature in logs after applying updates, and test that BFD sessions continue to operate without triggering reloads under malformed packet injection.

Typical attack path

  1. Identify reachable Catalyst 4500/4500-X or related switches running vulnerable IOS/IOS-XE versions with BFD enabled
  2. Craft a BFD control packet with a truncated or malformed header
  3. Transmit the packet to an interface participating in BFD sessions
  4. Trigger iosd crash and device reload, achieving denial of service

How to detect it

Search device syslog, crashinfo files, and SNMP traps for iosd process terminations or unexpected reloads correlated with BFD packet reception; review network flow data for anomalous BFD traffic from untrusted sources.

  • %IOSD-3-INVALID_BFD_HDR
  • BFD header length mismatch
  • iosd process crash dump containing BFD offload routines
  • Unexpected reload reason: 'BFD packet processing error'

What your security team should do

  • Prioritize patching all listed Catalyst models due to KEV status and confirmed in-the-wild exploitation
  • Inventory devices for BFD usage and apply ACLs to limit exposure where upgrades are delayed
  • Monitor for iosd process crashes and reload events in syslog and SNMP traps
  • Review and update network segmentation to reduce the attack surface for unauthenticated BFD traffic

The record

A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities