CVE-2018-0175

What it actually does

Format string vulnerability in the LLDP packet processing code allows an adjacent attacker to supply malicious format specifiers that corrupt memory or hijack control flow, resulting in denial of service or arbitrary code execution with elevated privileges.

Why it matters to the business

Successful exploitation can crash or fully compromise core network devices, causing prolonged outages across enterprise and industrial networks; the vulnerability remains on the CISA KEV list with a missed remediation deadline of 2022-03-17 and continues to see active exploitation in the wild.

How an attack unfolds

An attacker on the same Layer-2 segment crafts a malicious LLDP frame containing format-string specifiers and sends it to an affected Cisco IOS, IOS XE, or IOS XR device; the LLDP subsystem processes the frame without proper sanitization, triggering memory corruption that either crashes the device or allows the attacker to execute arbitrary code with elevated privileges.

How to fix it

Upgrade all affected Cisco IOS, IOS XE, and IOS XR installations to the fixed releases listed in Cisco Bug ID CSCvd73664; if upgrades are not immediately possible, disable LLDP on exposed interfaces and restrict adjacent access with port security or ACLs; Rockwell Automation devices should follow the corresponding Stratix firmware updates.

How to confirm the fix worked

Verify device software versions against the fixed releases for CSCvd73664; confirm LLDP is disabled on untrusted interfaces; monitor for unexpected device reloads correlated with LLDP packet reception.

Typical attack path

1. Gain adjacent network access to the target device
2. Craft a malicious LLDP advertisement containing format specifiers
3. Transmit the frame to trigger the vulnerable LLDP handler
4. Observe device crash for DoS or leverage memory corruption for code execution
5. Establish persistence or move laterally from the compromised device

How to detect it

Search device syslogs and SNMP traps for unexpected reloads or LLDP-related error messages around the time of suspected activity; inspect network captures for unusual LLDP frame sizes or content; correlate with threat actor activity targeting Cisco IOS platforms.

What your security team should do

• Immediately inventory all Cisco IOS/IOS-XE/IOS-XR and listed Stratix devices and apply available patches
• Disable LLDP on edge and untrusted ports until patches are deployed
• Implement Layer-2 controls such as BPDU guard or port security to limit LLDP exposure
• Add the CVE to existing KEV tracking dashboards and confirm remediation status
• Review logs for device crashes or anomalous LLDP traffic as indicators of prior exploitation