HowToFixMe
● High · CVSS 8.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2018-0167: Buffer overflow in Cisco IOS, IOS XE, and IOS XR

⚡ At a glance
Severity8.8 (High)
Actively exploited?Yes, listed in CISA KEV (added 2022-03-03)
AffectedCisco IOS, IOS XE, and IOS XR
Fixed inSee vendor advisory
Type (CWE)CWE-119: buffer overflow

Exploitation status

CVE-2018-0167 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: although a public exploit is not directly linked in this CVE’s primary references, its place on the CISA KEV catalog confirms working attack code is in active use in the wild. treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-17. Treat it as active exploitation, not theoretical.

What is CVE-2018-0167?

CVE-2018-0167 is one of a cluster of buffer overflow flaws in the Link Layer Discovery Protocol (LLDP) subsystem shared across Cisco IOS, Cisco IOS XE, and Cisco IOS XR Software. LLDP is a Layer 2 neighbor-discovery protocol: devices periodically broadcast LLDP frames on directly connected links to advertise their identity, capabilities, and management address. The vulnerable code parses incoming LLDP frames. Because the parser fails to validate the length of certain LLDP fields before copying them into fixed-size memory, a crafted LLDP packet can overrun the buffer.

This is classed as CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. The verbatim advisory description: "Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCuo17183, CSCvd73487."

Two outcomes matter here. The reliable one is denial of service: the device reloads or hangs when it processes the malformed frame, dropping every link that depends on it. The more severe one is remote code execution with elevated privileges on the network OS itself. The CVSS 3.1 base score is 8.8 (High), vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The AV:A (Adjacent Network) part is the key constraint: because LLDP is link-local and is not routed across Layer 3, the attacker must be on the same broadcast segment, physically plugged into a port, on the same VLAN, or behind a compromised neighboring device. No credentials and no user interaction are required.

Identify whether you are affected

This is a Cisco network-OS flaw, so every check runs on the device console or via SSH: not on a Linux or Windows host. Identify the software train first.

# Cisco IOS / IOS XE
show version | include Version
show version | include System image

# Cisco IOS XR
show version
show install active summary

Then confirm LLDP is actually running. If LLDP is globally disabled, the vulnerable parser is not reachable over the wire:

# IOS / IOS XE, is LLDP enabled, and on which interfaces?
show lldp
show lldp interface

# IOS XR
show lldp
show running-config lldp

Cross-reference your exact train and platform against the fixed releases table in the Cisco advisory cisco-sa-20180328-lldp. Cisco does not publish a single global fixed version for this CVE. the first fixed release differs by software train and platform, so the advisory's "Fixed Software" section (or the Cisco Software Checker) is the authoritative source for your specific image.

How to fix CVE-2018-0167

There is no configuration-only patch and no hotfix. The fix is to upgrade to a fixed Cisco software release for your train and platform. Because Cisco lists first-fixed releases per train rather than one universal build, you must look yours up before scheduling the upgrade.

Step 1, find your fixed release

Use the Cisco Software Checker or the "Fixed Software" table in the advisory. Do not guess a version: the correct target depends on the train you are running:

Step 2, upgrade (IOS / IOS XE)

Stage the fixed image, set it as the boot image, and reload during a maintenance window. Back up the running configuration first.

enable
! record current state for rollback
show version | include System image
copy running-config startup-config

! transfer the fixed image (SCP shown; TFTP/FTP also work)
copy scp: flash:
! point the loader at the fixed image
configure terminal
 boot system flash:<fixed-image>.bin
 end
write memory

! verify the boot variable, then reload in your window
show boot
reload

On IOS XE platforms that run in install mode, use the package workflow instead of bootflash boot statements:

install add file flash:<fixed-image>.bin activate commit
! the device reloads; afterwards confirm:
show install active summary

Step 2 (alt). upgrade (IOS XR)

# IOS XR install workflow
install add source <repo-or-tftp-path> <fixed-package>
install prepare <operation-id>
install activate <operation-id>
install commit
show install active summary

Step 3, verify the upgrade landed

# IOS / IOS XE
show version | include Version
# IOS XR
show install active summary

Confirm the reported release matches the fixed version you identified in Step 1 for your train, then re-run the Cisco Software Checker against the new version to confirm CVE-2018-0167 is no longer flagged.

If you can't patch immediately

There is no command that selectively hardens the LLDP parser. The only meaningful mitigation Cisco identifies is to reduce the attack surface by disabling LLDP where it is not required, and to control who can reach the affected ports. These reduce exposure; they do not remove the vulnerability. Apply them only after confirming LLDP is not load-bearing in your topology (some data-center fabrics, IP phones, and management tooling depend on it).

Disable LLDP where it is not needed (IOS / IOS XE)

configure terminal
! turn LLDP off globally
no lldp run
end
write memory

! or, keep it global but disable per untrusted interface
configure terminal
interface GigabitEthernet0/1
 no lldp transmit
 no lldp receive
end
write memory

Restrict who can reach affected segments

Because the attacker must be on an adjacent (same-segment) link, locking down physical and VLAN access materially reduces risk. Shut or isolate unused access ports and keep untrusted devices off the LLDP segment:

configure terminal
interface range GigabitEthernet0/2 - 24
 shutdown
end
write memory

Frequently asked questions

Can this be exploited from the internet?

No. The CVSS vector is AV:A (Adjacent Network). LLDP frames are link-local and are not forwarded across Layer 3 boundaries, so the attacker must be on the same physical segment or VLAN as the affected device: for example, a device plugged into a switch port or a compromised neighbor. That constraint is why the score is 8.8 rather than 9.x, but it is still rated High because no authentication or user interaction is needed.

Which exact version do I upgrade to?

Cisco does not publish one global fixed version for CVE-2018-0167. The first fixed release depends on your software train and platform. Run the Cisco Software Checker or read the "Fixed Software" table in advisory cisco-sa-20180328-lldp, match it to the train shown by show version, and upgrade to that release.

Is disabling LLDP a permanent fix?

No. no lldp run removes the exposed parser from the wire, but it is a mitigation, not a remediation, the vulnerable code is still in the image and any service that needs LLDP (some VoIP and data-center fabric features) will break. Treat it as a stopgap until you can install a fixed release.

Why does this affect IOS, IOS XE, and IOS XR all at once?

The three operating systems share the same LLDP subsystem code lineage, so the length-validation defect (CWE-119) exists across all of them. That is why a single CVE spans all three, and why the fixed-release table is broken out per train rather than per OS.

References

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Other defects in the same area that deserve attention during this patch cycle:

People also ask

Can CVE-2018-0167 be exploited from the internet?

No. The CVSS vector is AV:A (Adjacent Network). LLDP frames are link-local and are not routed across Layer 3, so the attacker must be on the same physical segment or VLAN as the affected device. No authentication or user interaction is required, which is why it is still rated 8.8 High.

Which exact Cisco version fixes CVE-2018-0167?

Cisco does not publish one global fixed version. The first fixed release depends on your software train and platform. Run the Cisco Software Checker or read the Fixed Software table in advisory cisco-sa-20180328-lldp and match it to the train shown by show version.

Is disabling LLDP a permanent fix?

No. Running no lldp run removes the exposed parser from the wire but is a mitigation, not a remediation. The vulnerable code remains in the image and any feature that depends on LLDP will break. Use it as a stopgap until you install a fixed release.

Why does it affect IOS, IOS XE, and IOS XR together?

The three operating systems share the same LLDP subsystem code lineage, so the length-validation defect (CWE-119) exists across all of them. That is why a single CVE spans all three and why the fixed-release table is broken out per train.