CVE-2018-0174

HighCVSS 8.6/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuh91645.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Cisco IOS and IOS XE	Cisco IOS and IOS XE

References

http://www.securityfocus.com/bid/103554Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040591Broken Link, Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05Third Party Advisory, US Government Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3Vendor Advisory
https://www.tenable.com/security/research/tra-2018-06Third Party Advisory
http://www.securityfocus.com/bid/103554Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040591Broken Link, Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05Third Party Advisory, US Government Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3Vendor Advisory
https://www.tenable.com/security/research/tra-2018-06Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0174US Government Resource

Timeline

Published: Mar 28, 2018
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 3, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-01758.0Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IO CVE-2018-01767.8Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the under CVE-2018-01777.5A vulnerability in the IP Version 4 (IPv4) processing code of Cisco IOS XE Software running on Cisco Catalyst 3850 and Cisco Catalyst 3650 S CVE-2018-01795.9Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attack CVE-2018-01805.9Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attack CVE-2018-01819.8A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software CVE-2018-01827.8Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary command CVE-2018-01836.7A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Lin CVE-2018-01846.7A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Lin CVE-2018-01857.8Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary command CVE-2018-01866.1Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker t CVE-2018-01876.5A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confiden