CVE-2018-0167: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

CVE-2018-0167 is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software. An unauthenticated attacker on an adjacent network segment could trigger it to cause a denial of service or execute arbitrary code on the device. Because these platforms commonly sit at the core of enterprise and service-provider networks, a successful attack can disrupt routing, switching, or management connectivity and give an adversary a foothold for further movement. Confirm exact impact and fixed releases against the vendor advisory.

How it works

The weakness is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer). LLDP is a Layer-2 neighbor-discovery protocol that devices use to exchange identity and capability information. When the LLDP subsystem processes a specially crafted frame, it can write past the end of an allocated buffer. That memory corruption can crash the process or the device (denial of service) or, under the right conditions, allow the attacker to run code with the privileges of the affected software. Because LLDP operates at Layer 2, the attacker must be able to send frames directly onto a link that the target device is listening on; remote Internet exposure is not required. No public exploit mechanics beyond this class description are supplied here; treat any proof-of-concept claims as unverified until matched to the vendor advisory.

Am I affected? How to find it in your systems

Cisco IOS, IOS XE, and IOS XR run on a wide range of routers, switches, and aggregation platforms. Inventory every device that could be running these operating systems—campus and data-center switches, edge routers, and any appliance that advertises or accepts LLDP. Use your configuration-management database, network-management platform, or CLI commands such as show version and show lldp to list software trains and confirm whether LLDP is enabled on any interface. Compare the running image against the fixed versions listed in the Cisco advisory for CVE-2018-0167; do not rely on generic version ranges. Look for unexpected LLDP traffic spikes, interface flaps, or process restarts in syslog and SNMP traps that coincide with neighbor discovery activity. Packet captures on management or access VLANs can reveal malformed LLDP PDUs if you suspect active probing.

• Enumerate all Cisco IOS / XE / XR devices and record exact image names.
• Check whether LLDP is globally or per-interface enabled.
• Review recent crash dumps or traceback logs for LLDP-related faults.
• Confirm exposure only against the official vendor fixed-release list.

How to remediate

The primary remediation is to apply the software updates Cisco published for this vulnerability. Follow the vendor’s upgrade path for each platform, verify image integrity, and schedule the reload during a maintenance window. After patching, re-validate that LLDP still functions as required and that no residual crash indicators appear. As hardening for the broader buffer-overflow class, keep LLDP disabled on interfaces that do not need neighbor discovery, restrict Layer-2 adjacency to trusted devices only, and ensure control-plane policing is in place so that unexpected protocol traffic cannot overwhelm the CPU. Document the change and retain pre- and post-upgrade configuration snapshots.

If you can't patch immediately

Until the vendor update can be installed, reduce the attack surface. Disable LLDP on all interfaces where it is not operationally required; if neighbor discovery is mandatory, limit it to a small set of trusted ports and apply Layer-2 access controls or private VLANs so that untrusted hosts cannot inject frames. Segment management and user traffic so that an adjacent attacker on an access port cannot reach core routing engines. If a network-based IPS or control-plane protection feature can filter anomalous LLDP PDUs, enable it as a temporary virtual patch—test thoroughly to avoid breaking legitimate discovery. Increase monitoring for LLDP-related process crashes, unexpected neighbor changes, and high CPU attributed to the LLDP process, and alert on those signatures until the patch is deployed.

• Disable LLDP where possible.
• Restrict Layer-2 adjacency and apply port security.
• Use control-plane policing or ACLs to limit LLDP sources.
• Monitor for crashes and anomalous neighbor events.

If your data may have been exposed

Actively exploited network-device vulnerabilities can lead to broader compromise and data exposure even when ransomware use has not been documented for this CVE. If you have evidence of successful exploitation, treat the device as untrusted, isolate it, preserve memory and logs for forensics, and rotate any credentials or keys that traversed the platform. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related accounts appear in prior incidents.