CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2018-03-28
Cisco IOS and IOS XE Smart Install Remote Code Execution and DoS Vulnerability (CVE-2018-0171) Security Advisory
[Affected Scope] Cisco network switches and routers running Cisco IOS and IOS XE Software with the Smart Install client feature enabled.
[Impact] Unauthenticated, remote attackers can send crafted packets to TCP port 4786, triggering a heap-based buffer overflow that leads to device reload (DoS) or arbitrary code execution (RCE) with elevated privileges.
[Mitigation] Disable the Smart Install feature using the 'no vstack' command, or restrict access to TCP port 4786 using Infrastructure Access Control Lists (ACLs) if the feature is required.