Cisco IOS / IOS XE / IOS XR LLDP Subsystem Buffer Overflow Vulnerability (CVE-2018-0167)
Executive & SecOps Summary
SECOPS ASSESSMENTCisco IOS, IOS XE, and IOS XR Software with Link Layer Discovery Protocol (LLDP) enabled
An unauthenticated, adjacent attacker could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) condition
Apply official Cisco software updates or disable LLDP globally/per-interface as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Verify the current software version and upgrade to a patched release recommended by Cisco.
# Check current IOS/IOS XE version
show version | include Software
# Example: Download secure image via TFTP and set boot path
copy tftp: flash:
# Address or name of remote host? 192.168.1.100
# Source filename? c3750e-universalk9-mz.152-4.E10.bin
# Destination filename [c3750e-universalk9-mz.152-4.E10.bin]?
configure terminal
boot system flash:/c3750e-universalk9-mz.152-4.E10.bin
end
write memory
reload2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, disable LLDP globally or on untrusted interfaces to mitigate the risk.
configure terminal
# Option A: Disable LLDP globally
no lldp run
# Option B: Disable LLDP on specific untrusted interfaces
interface GigabitEthernet0/1
no lldp transmit
no lldp receive
end
write memory3. Log Audit & IoC Verification Commands
Monitor LLDP traffic statistics and system logs for signs of anomalous behavior or crash events.
# Check LLDP neighbor status and traffic statistics
show lldp neighbors
show lldp traffic
# Inspect system logs for memory allocation failures or unexpected reboots
show stacks
dir crashinfo:
show logging | include LLDP|ALIGN-3-SPURIOUS|SYS-2-MALLOCFAILStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2018-0167) exists in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS, IOS XE, and IOS XR Software. The root cause is a boundary error (CWE-119) when parsing specific Type-Length-Value (TLV) fields or structures within incoming LLDP packets. The software fails to properly validate the length of input data before copying it into memory buffers, leading to a buffer overflow.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must be adjacent to the target device (sharing the same Layer 2 broadcast domain). The attacker crafts a malicious LLDP packet containing anomalous TLV values and transmits it to an LLDP-enabled interface on the target Cisco device. When the LLDP daemon processes this packet, the lack of bounds checking triggers a heap or stack overflow, allowing the attacker to corrupt system memory, crash the device, or execute arbitrary shellcode with administrative privileges.
3. Infrastructure & Business Impact
With a CVSS score of 8.8 (High) and its inclusion in the CISA KEV catalog, this vulnerability represents a severe threat to enterprise networks. Successful exploitation allows complete compromise of core routing and switching infrastructure. This can lead to traffic interception, Man-in-the-Middle (MitM) attacks, and lateral movement into internal networks, severely disrupting business operations.
Official Vendor Advisories & References
Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487.
Frequently Asked SecOps Questions (CVE-2018-0167)
FAQQ1. How critical is CVE-2018-0167 and is it actively exploited in the wild?
CVE-2018-0167 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 3.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2018-0167?
Primary impacted vendors include cisco across ios, ios_xe, ios_xr. Scope summary: All Cisco IOS, IOS XE, and IOS XR Software versions with LLDP enabled (Cisco Bug IDs: CSCuo17183, CSCvd73487)
Q3. What temporary mitigations or workarounds exist for CVE-2018-0167 before patching?
[Mitigation] Apply official Cisco software updates or disable LLDP globally/per-interface as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2018-0167
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cisco)
View Category →Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Cisco Secure Firewall Management Center (FMC) Insecure Deserialization Vulnerability (CVE-2026-20131, CVSS 10.0) - Remote Code Execution and Root Privilege Escalation
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.