CVE-2018-0174

What it actually does

The flaw performs incomplete input validation on DHCPv4 option 82 data received from relay agents, allowing a crafted packet to trigger an unhandled condition that forces a device reload.

Why it matters to the business

Remote unauthenticated attackers can trigger repeated device reloads on widely deployed Cisco IOS and IOS-XE platforms, causing extended network outages, loss of connectivity for dependent services, and operational disruption across enterprise and industrial environments.

How an attack unfolds

An attacker sends a single crafted DHCPv4 packet containing malformed option 82 encapsulation directly to an exposed interface; the device fails to validate the input, enters an error path, and reloads, producing a denial-of-service condition. Because the vulnerability is listed in CISA KEV and has been actively exploited in the wild, automated scanning or targeted campaigns against edge routers and switches are feasible.

How to fix it

Upgrade all affected Cisco IOS and IOS-XE releases to the fixed versions published in Cisco security advisory CSCuh91645; where upgrades are not immediately possible, apply configuration workarounds such as disabling DHCP relay agent functionality or implementing infrastructure ACLs that drop DHCP packets from untrusted sources. Rockwell Automation Stratix devices sharing the same code base must receive the corresponding vendor patches.

How to confirm the fix worked

After applying updates, confirm the running image version matches the fixed release, verify that DHCP option 82 processing no longer triggers reloads under test traffic, and review device logs for absence of the CSCuh91645 crash signature.

Typical attack path

1. Locate internet-facing or internally reachable Cisco IOS/IOS-XE devices that process DHCPv4 traffic
2. Craft a DHCPv4 packet with invalid option 82 encapsulation data
3. Transmit the packet to the device management or data-plane interface
4. Observe device reload and repeat as needed to maintain denial of service

How to detect it

Search device syslog and crashinfo files for reload events correlated with DHCP packet processing; inspect network flow or packet-capture repositories for DHCPv4 traffic containing option 82 originating from unexpected sources; review historical logs around the 2018 publication date and any subsequent KEV activity windows for sudden device reboots without configuration changes.

• CSCuh91645
• DHCPv4 packet with malformed option 82
• Unexpected reload triggered by DHCP relay input

What your security team should do

• Treat as high-priority remediation due to KEV listing and active exploitation; complete upgrades before any remaining internal deadlines
• Inventory all Cisco IOS, IOS-XE, and listed Rockwell Stratix devices and map them to fixed releases
• Implement compensating controls (infrastructure ACLs, DHCP snooping) on unpatched devices
• Monitor vendor advisory updates for newly published fixed images