CVE-2018-0172

High · 8.6 CISA KEV

CVSS

8.6

EPSS

7.8%

Published

Mar 28, 2018

CISA due date

Mar 17, 2022

Cloudanix analysis

Act now SSVC: Attend

Attackers can send a specially made network message that crashes certain Cisco and Rockwell switches, knocking entire networks offline until they restart.

Active In The Wild

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Denial Of Service
Component: Network Service
Class: Memory Corruption
Remediation: Upgrade
Effort: Medium
Patch risk: Medium

What it actually does

Incomplete validation of DHCPv4 option 82 data from relay agents triggers a heap overflow in the DHCP handling code, causing the device to reload.

Why it matters to the business

Network devices experience sudden restarts leading to prolonged outages; the issue remains actively exploited years after disclosure with a past CISA deadline, amplifying risk across widespread Cisco and Rockwell Automation deployments.

How an attack unfolds

An attacker sends a single crafted DHCPv4 packet containing malicious option 82 information to a listening interface; the malformed data bypasses input checks, overflows a heap buffer, and forces an immediate device reload. Active exploitation has been observed against Cisco IOS and IOS XE devices.

How to fix it

Upgrade all affected Cisco IOS and IOS XE releases to the fixed versions published under CSCvg62730; where upgrades are delayed, apply infrastructure ACLs to block untrusted DHCP traffic and disable DHCP relay on edge interfaces.

How to confirm the fix worked

Compare running software versions against the fixed releases listed in CSCvg62730; confirm absence of the vulnerability by testing that crafted option 82 packets no longer produce reloads in a lab environment.

Typical attack path

Locate exposed Cisco IOS/IOS XE or compatible Rockwell Automation switches accepting DHCPv4 traffic
Craft a DHCPv4 packet with oversized or malformed option 82 sub-options
Transmit the packet to the device from any network position that can reach a DHCP-enabled interface
Trigger heap corruption that forces an immediate reload and denial of service

How to detect it

Search device syslog and crashinfo files for reloads preceded by DHCP packet processing; inspect network captures for anomalous DHCPv4 packets containing option 82 data from unexpected sources.

%SYS-2-MALLOCFAIL.*DHCP
DHCPv4 option 82 processing crash
reload due to heap overflow in DHCP relay path

What your security team should do

Prioritize patching of all internet-facing and internal Cisco IOS/IOS XE devices given confirmed KEV status and active exploitation
Implement network segmentation and DHCP snooping to limit exposure to crafted relay packets
Monitor device logs for unexpected reloads correlated with DHCP traffic spikes
Review downstream Rockwell Automation product inventories for parallel upgrades

The record

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow condition on the affected device, which will cause the device to reload and result in a DoS condition. Cisco Bug IDs: CSCvg62730.

Affected packages

Ecosystem	Package	Introduced	Fixed