CVE-2018-0167

What it actually does

Multiple buffer overflows in the LLDP subsystem allow unauthenticated adjacent attackers to trigger memory corruption leading to denial of service or arbitrary code execution with elevated privileges.

Why it matters to the business

Compromised or crashed network devices can disrupt connectivity and operations across many organizations; listed in CISA KEV with a 2022-03-17 deadline and active exploitation in the wild increases urgency for remediation.

How an attack unfolds

An attacker on the same network segment crafts malicious LLDP packets that overflow buffers in the LLDP processing code of affected Cisco IOS, XE, or XR devices, resulting in code execution or device crash; observed in the wild by threat actors targeting Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability.

How to fix it

Apply vendor-supplied patches for the affected Cisco IOS, XE, and XR releases; where curl (Alpine:v3.10) packages appear in environments, update to 7.54.0-r0.

How to confirm the fix worked

Confirm devices are running fixed software versions and test that LLDP packets no longer trigger crashes or unexpected behavior; scan for remaining vulnerable versions using vendor advisories.

Typical attack path

1. Gain access to the same Layer 2 network segment as the target device
2. Send specially crafted LLDP frames to the device
3. Trigger buffer overflow to achieve denial of service or elevated code execution

How to detect it

Review network traffic captures and device logs for anomalous LLDP packets or unexpected process crashes on Cisco IOS/XE/XR systems; correlate with threat actor activity tied to Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability.

What your security team should do

• Prioritize patching of internet-facing and critical Cisco devices before the KEV due date
• Disable LLDP on untrusted interfaces where operationally feasible
• Monitor EPSS and exploit maturity trends for any increase in observed activity