How to Fix CVE-2018-0151: Buffer overflow in Cisco IOS and IOS XE

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-17. Treat it as active exploitation, not theoretical.

What is CVE-2018-0151?

CVE-2018-0151 is a buffer overflow (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software. The device performs incorrect bounds checking on certain values inside packets destined for UDP port 18999 on the device itself. An unauthenticated, remote attacker who can send crafted packets to that port can overflow the buffer and either execute arbitrary code with elevated privileges or crash the device into a reload.

Two properties make this one dangerous. First, it needs no authentication and no user interaction: that is why it scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). Second, successful code execution runs with elevated privileges on the network operating system, which means a single packet stream can hand an attacker control of a router or switch that sits in your data path. The denial-of-service variant is the softer landing: the device reloads, drops every session it was carrying, and comes back up only to be hit again.

One detail decides your exposure: the malicious packets must be destined to and processed by the affected device. Traffic merely transiting the device does not trigger the flaw. So a router whose own interface addresses are reachable from an untrusted segment on UDP 18999 is at risk; a device whose control plane is firewalled off from untrusted sources is much harder to reach. Cisco tracks this internally as bug ID CSCvf73881.

Am I affected?

This affects Cisco IOS and Cisco IOS XE software broadly, the MITRE record does not narrow it to a version range, and the fix differs per platform and train. From the device CLI, confirm what you are running:

# Cisco IOS / IOS XE. identify the running image and train
show version | include Version
show version | include image

Then check whether that exact image is vulnerable. The authoritative source is the Cisco Software Checker and the advisory cisco-sa-20180328-qos, paste your IOS/IOS XE release into the checker and it returns the first fixed release for your platform. Do not rely on third-party version tables; only Cisco's checker maps your specific image to a fixed build for this CVE.

How to fix CVE-2018-0151

The only complete fix is to upgrade to a fixed Cisco IOS or IOS XE image. Cisco did not publish one universal fixed version for this CVE: the first fixed release depends on your platform and software train. Look up your exact image in the Cisco Software Checker (or the advisory linked in References) to get the target build, then upgrade to it.

Upgrade procedure (Cisco IOS / IOS XE)

# Run from the device console / SSH session in enable mode
enable
show version | include Version          ! record the current build
copy running-config startup-config      ! save config before the change

# Copy the fixed image (from Cisco Software Checker) onto the device
copy tftp: flash:
! enter TFTP server IP and the fixed image filename when prompted
verify /md5 flash:<fixed-image>.bin     ! confirm the image is intact

# Point the device at the fixed image and reload
configure terminal
 boot system flash:<fixed-image>.bin
 end
write memory
reload

After the device comes back up, run show version | include Version and confirm the build matches the fixed release you pulled from the Software Checker. There is no service to restart and no kernel module to reload, on IOS and IOS XE the fix is the new system image, so the reload is mandatory.

Operator runbook for a fleet

Run this from a management workstation that can reach the device over SSH and reach a TFTP server hosting the fixed image. It records the current version, backs up the running config off-box, copies the fixed image, sets the boot variable, and reloads. Supply the fixed image name you obtained from the Cisco Software Checker.

#!/usr/bin/env bash
# CVE-2018-0151 upgrade runbook for Cisco IOS / IOS XE
# Fixed image must come from the Cisco Software Checker (cisco-sa-20180328-qos)
set -euo pipefail
DEVICE="${1:?usage: $0   }"
IMAGE="${2:?fixed image filename required}"
TFTP="${3:?tftp server ip required}"
LOG="cve-2018-0151-$(date +%Y%m%d-%H%M%S).log"

echo "[1/4] Recording current version and backing up config from $DEVICE"
ssh admin@"$DEVICE" "show version | include Version" | tee -a "$LOG"
ssh admin@"$DEVICE" "copy running-config tftp://$TFTP/cve-2018-0151-pre.cfg"

echo "[2/4] Copying fixed image $IMAGE via TFTP and verifying"
ssh admin@"$DEVICE" "copy tftp://$TFTP/$IMAGE flash:$IMAGE" | tee -a "$LOG"
ssh admin@"$DEVICE" "verify /md5 flash:$IMAGE" | tee -a "$LOG"

echo "[3/4] Setting boot image and reloading"
ssh admin@"$DEVICE" "configure terminal
 boot system flash:$IMAGE
 end
 write memory
 reload" | tee -a "$LOG"

echo "[4/4] Wait for reload, then confirm the fixed build is running"
ssh admin@"$DEVICE" "show version | include Version" | tee -a "$LOG"
echo "Confirm the reported build matches the fixed release from the Software Checker"

If you can't upgrade immediately

Cisco lists no workaround that removes the vulnerable QoS code. only the fixed image does that. But because the attack requires packets destined to UDP port 18999 on the device's own addresses, you can shrink the attack surface while you schedule the upgrade. These are mitigations, not fixes.

Infrastructure ACL: block UDP 18999 to the device

# Deny UDP 18999 to the router's own addresses from untrusted sources,
# permit everything else. Apply inbound on untrusted-facing interfaces.
configure terminal
ip access-list extended iACL-CVE-2018-0151
 deny   udp any host <device-interface-ip> eq 18999
 permit ip any any
exit
interface <untrusted-facing-interface>
 ip access-group iACL-CVE-2018-0151 in
end
write memory

Control plane policing (CoPP)

# Rate-limit / drop traffic to UDP 18999 punted to the control plane
configure terminal
ip access-list extended CoPP-CVE-2018-0151
 permit udp any any eq 18999
class-map match-all CM-CVE-2018-0151
 match access-group name CoPP-CVE-2018-0151
policy-map CoPP-IN
 class CM-CVE-2018-0151
  drop
control-plane
 service-policy input CoPP-IN
end
write memory

Restrict these to your environment's real management and peering subnets, and remove them once the fixed image is in place. Lock down vty access to trusted subnets while you are at it:

# Restrict device management access to a trusted subnet
configure terminal
access-list 99 permit 10.0.0.0 0.255.255.255
line vty 0 15
 access-class 99 in
end
write memory

Verify the fix

After the reload, confirm three things on the device:

# 1. The running image matches the fixed release from the Software Checker
show version | include Version

# 2. The device booted the image you set, not a fallback
show bootvar

# 3. (If you applied them) the temporary iACL/CoPP can now be removed
show running-config | include access-group|service-policy

The fix is confirmed only when show version reports a build at or above the first fixed release Cisco lists for your platform in cisco-sa-20180328-qos. Once that is true, back out any UDP 18999 ACL or CoPP entries you added so they do not mask a future regression.

Frequently asked questions

Is CVE-2018-0151 actually being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03, which confirms working attack code is in active use. CISA's own analysis flags exploitation as active, automatable, and capable of total technical impact. Because it is unauthenticated and scores CVSS 9.8, treat the upgrade as an emergency change rather than a scheduled one.

Which Cisco IOS or IOS XE releases are fixed?

There is no single fixed version that covers every platform. Cisco published per-platform fixed releases, so the first fixed build depends on your exact IOS or IOS XE train. Enter your running release into the Cisco Software Checker (advisory cisco-sa-20180328-qos) to get the target build, then upgrade to it. Do not trust third-party version tables for this.

Can I mitigate it without upgrading?

Cisco lists no workaround that fixes the vulnerable QoS code. The attack only works when crafted packets reach UDP port 18999 on the device's own addresses and are processed locally, transit traffic does not trigger it. You can blunt exposure with an infrastructure ACL or control plane policing that drops UDP 18999 from untrusted sources to the device, but that is a stopgap until you load a fixed image.

Do I need to reload the device after upgrading?

Yes. On Cisco IOS and IOS XE the fix ships as a new system image, so you copy the fixed image to flash, set the boot system variable, and reload. There is no live-patch or service restart path for this: the device must boot the fixed image. Confirm with show version afterward.

References

• Official vendor advisory: https://ics-cert.us-cert.gov/advisories/ICSA-18-107-03
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-0151
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• http://www.securityfocus.com/bid/103540
• http://www.securitytracker.com/id/1040582
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-qos
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0151

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Related fixes

Other Cisco IOS / IOS XE vulnerabilities worth patching alongside this one:

• How to Fix CVE-2018-0171
• How to Fix CVE-2018-0159
• How to Fix CVE-2018-0175
• How to Fix CVE-2018-0154