Cisco IOS / IOS XE / IOS XR LLDP Subsystem Format String Vulnerability (CVE-2018-0175) Technical Analysis and Hardening Guide
Executive & SecOps Summary
SECOPS ASSESSMENTCisco devices running Cisco IOS, IOS XE, or IOS XR Software with Link Layer Discovery Protocol (LLDP) enabled.
An unauthenticated, adjacent attacker can send crafted LLDP packets to trigger a denial of service (DoS) or execute arbitrary code with elevated privileges.
Apply official Cisco software updates immediately, or disable LLDP globally/per-interface as a temporary workaround.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to the Cisco Security Advisory to identify and download the fixed software release for your platform.
# Example: Upgrading Cisco IOS image via TFTP
Router# copy tftp: flash:
Address or name of remote host? 192.168.1.100
Source filename? c3750e-universalk9-mz.152-4.E8.bin
Destination filename [c3750e-universalk9-mz.152-4.E8.bin]?
# Configure boot path and save configuration
Router(config)# boot system flash:/c3750e-universalk9-mz.152-4.E8.bin
Router(config)# end
Router# write memory
Router# reload2. Temporary Workaround & Hardening Configuration
If patching cannot be scheduled immediately, disable LLDP globally to mitigate the attack vector.
# Disable LLDP globally
Router# configure terminal
Router(config)# no lldp run
Router(config)# end
Router# write memory
# Alternatively, disable LLDP on untrusted interfaces
Router(config)# interface GigabitEthernet0/1
Router(config-if)# no lldp transmit
Router(config-if)# no lldp receive
Router(config-if)# end3. Log Audit & IoC Verification Commands
Verify the status of LLDP and inspect system logs for unexpected reboots or memory errors.
# Check LLDP status and neighbors
Router# show lldp
Router# show lldp neighbors
# Inspect system logs for crash history
Router# show version | include returned to
Router# show log | include %SYSTEM-1-LOG or %SYS-2-MALLOCStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2018-0175) exists in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS, IOS XE, and IOS XR Software. The root cause is improper validation of input data within LLDP packet parsing, leading to a format string vulnerability (CWE-134) and buffer overflow (CWE-119). When processing specific TLV (Type-Length-Value) fields, the software fails to sanitize format specifiers before passing them to formatting functions.
2. Exploitation Mechanics & Attack Scenario
An attacker located in the same broadcast domain (adjacent network layer) can exploit this vulnerability without authentication. By transmitting a specially crafted LLDP frame containing malicious format string specifiers (such as '%x' or '%n'), the attacker forces the LLDP daemon to read or write arbitrary memory locations. This can lead to memory corruption, causing the device to crash and reload (DoS), or allowing the execution of arbitrary code with administrative privileges.
3. Infrastructure & Business Impact
As a CISA KEV-listed vulnerability, CVE-2018-0175 poses a severe threat to enterprise infrastructure. Successful exploitation allows complete compromise of core routing and switching infrastructure. This can result in widespread network outages, data interception, and lateral movement within the internal network.
Official Vendor Advisories & References
Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.
Frequently Asked SecOps Questions (CVE-2018-0175)
FAQQ1. How critical is CVE-2018-0175 and is it actively exploited in the wild?
CVE-2018-0175 is rated CVSS 8.0 (HIGH) with a 30-day EPSS exploitation probability of 3.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2018-0175?
Primary impacted vendors include cisco across ios, ios_xe, ios_xr. Scope summary: Cisco IOS, IOS XE, and IOS XR Software with LLDP enabled globally (Cisco Bug ID: CSCvd73664).
Q3. What temporary mitigations or workarounds exist for CVE-2018-0175 before patching?
[Mitigation] Apply official Cisco software updates immediately, or disable LLDP globally/per-interface as a temporary workaround. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2018-0175
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cisco)
View Category →Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Cisco Secure Firewall Management Center (FMC) Insecure Deserialization Vulnerability (CVE-2026-20131, CVSS 10.0) - Remote Code Execution and Root Privilege Escalation
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.