CVE-2018-0156

7.5 highKEVEPSS 9.4%

High (7.5) in Cisco IOS Software and Cisco IOS XE Software. In CISA KEV since 2022-03-03. EPSS 9.4% chance of exploitation in the next 30 days.

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 9.4% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2022-03-03, due 2022-03-17
CWEs: CWE-20, CWE-399
Published: 2018-03-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cisco:ios
cisco:ios_xe

References

Check your stack JSON