CVE-2018-0155: Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability

CVE-2018-0155 is a denial-of-service vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation on Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches. An unauthenticated remote attacker can trigger a crash of the iosd process, disrupting switch operation. For network teams this matters because these platforms often sit in core or distribution roles; a successful attack can interrupt forwarding and management until the device recovers.

Public detail is limited to the CISA description and the stated weakness class. Confirm exact exposure, fixed software, and any configuration prerequisites against the vendor advisory before acting.

How it works

The weakness is categorized as CWE-388 (error handling). In this case the flaw resides in how the switch’s BFD offload path processes certain traffic. BFD is a lightweight protocol used to detect forwarding-path failures quickly; when offloaded to hardware or specialized code paths, malformed or unexpected BFD-related packets can reach that path.

An unauthenticated remote attacker who can send traffic that reaches the vulnerable BFD offload implementation may cause the iosd process to crash. Loss of iosd produces a denial-of-service condition on the switch. No further exploit mechanics, packet formats, or preconditions are supplied in the available facts; treat any public proof-of-concept claims cautiously and validate them only against official vendor information.

Am I affected? How to find it in your systems

The vulnerability affects Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches that implement BFD offload. These devices commonly appear in campus distribution, collapsed-core, and data-center edge roles.

• Inventory all Catalyst 4500 and 4500-X platforms via your network management system, CDP/LLDP tables, or configuration backups.
• On each device, identify the running software image and whether BFD is configured or offloaded; exact version ranges and feature flags must be confirmed against the vendor advisory.
• Review interface and control-plane configurations for BFD neighbors or BFD-enabled routing protocols.
• Telemetry signs of exploitation are primarily sudden iosd restarts, unexpected reload or crash logs, and loss of forwarding or management reachability coincident with BFD-related traffic. Capture and retain crashinfo or core files if a crash occurs, and correlate with NetFlow or packet captures showing unusual BFD activity from untrusted sources.

How to remediate

Patch first. Apply the software updates specified by Cisco for the affected Catalyst 4500 and 4500-X platforms, following the vendor’s installation and verification instructions. CISA’s required action is simply to apply updates per vendor instructions.

• Schedule the upgrade in a maintenance window appropriate to the device’s role; verify image integrity and perform post-upgrade checks of BFD sessions and overall forwarding.
• After patching, confirm that BFD offload behavior matches the fixed release notes.
• As general hardening for this class of issue, restrict control-plane traffic with infrastructure ACLs or Control Plane Policing so that only legitimate BFD peers can reach the switch’s BFD processing path, and disable BFD on interfaces or VRFs where it is not required.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment management and control-plane reachability so that untrusted networks cannot send packets to the switch’s BFD offload path.
• Apply infrastructure ACLs or CoPP policies that permit BFD only from known peer addresses and drop or rate-limit unexpected BFD traffic.
• If operationally feasible, disable BFD or BFD offload on affected devices until the patch is installed; verify impact on routing convergence first.
• Increase monitoring for iosd crashes, unexpected reloads, and anomalous BFD packet rates; alert on these conditions and retain logs for later analysis.
• Virtual patching via a network firewall or IDS/IPS may be possible if the vendor or a trusted signature provider publishes specific detections; treat such signatures as temporary and still plan for the software update.

If your data may have been exposed

This vulnerability is a denial-of-service condition; the supplied facts do not document data exfiltration or ransomware use. Nevertheless, any actively exploited network-device vulnerability can be a stepping stone to broader compromise. If you observe crashes or suspicious traffic consistent with exploitation, treat the incident as a potential intrusion: isolate affected devices, preserve logs and crashinfo, and follow your incident-response process. As a routine hygiene step, you can run a free exposure scan of your email addresses against known breach data sets to check whether credentials or other information have appeared in prior breaches unrelated to this CVE.