How to Fix CVE-2018-0172: Improper input validation in Cisco IOS and IOS XE

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-17. Treat it as active exploitation, not theoretical.

What is CVE-2018-0172?

CVE-2018-0172 is a denial-of-service flaw in the DHCP relay agent code of Cisco IOS and Cisco IOS XE Software. The DHCP relay agent inserts option 82 (the DHCP Relay Agent Information option) into DHCPv4 packets so that a downstream DHCP server can identify which switch port or circuit a client request arrived on. The bug lives in the option 82 encapsulation path: the software performs incomplete input validation (CWE-20) of the option 82 sub-option data it receives in DHCPv4 packets from relay agents. A crafted DHCPv4 packet drives a heap overflow, the device reloads, and traffic forwarding stops until the box comes back up.

This is a pure availability problem. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H: confidentiality and integrity impact are both NONE, and only availability is HIGH. An unauthenticated attacker who can reach the DHCP service of an affected device can crash it, but there is no remote code execution and no privilege escalation in this CVE. The crash repeats as long as the malicious packets keep arriving, so a script that replays the packet turns into a sustained outage. Cisco tracks the defect as bug ID CSCvg62730.

Am I affected?

This CVE only affects Cisco IOS and Cisco IOS XE devices that have the DHCP relay agent feature in the data path. From the device CLI, confirm the running train and whether DHCP relay is configured:

# Confirm the running IOS / IOS XE version
show version | include (Version|IOS)

# Is the device acting as a DHCP relay agent?
show running-config | include ip helper-address
show running-config | include ip dhcp relay information

# List interfaces that forward DHCP (ip helper-address present)
show ip interface | include helper

If ip helper-address or DHCP relay information options appear anywhere in the configuration, the option 82 code path is reachable and the device is exposed. The fixed train for your specific platform and feature set is listed only in the Cisco advisory (cisco-sa-20180328-dhcpr1). Cisco published per-release first-fixed builds rather than a single global version, so check your exact release there.

How to fix CVE-2018-0172

The only complete fix is to upgrade Cisco IOS or IOS XE to a release that Cisco lists as first-fixed for your platform. Cisco did not publish a single patched version number for this CVE; the first-fixed build differs per release train and per hardware family. Look up your exact running release in the Cisco IOS Software Checker on the advisory page (cisco-sa-20180328-dhcpr1) to get the correct target image, then upgrade to it. There is no apt, yum, or winget package for this; it is a network OS image swap.

Upgrade procedure (on the device)

! 1. Confirm current release and free flash space
show version | include (Version|IOS)
dir flash: | include free

! 2. Save the current configuration
copy running-config startup-config

! 3. Copy the Cisco-verified fixed image to flash (TFTP, FTP, SCP, or USB)
copy tftp://10.0.0.10/<fixed-image>.bin flash:<fixed-image>.bin

! 4. Verify the image hash matches the value on Cisco's download page
verify /md5 flash:<fixed-image>.bin

! 5. Point the boot variable at the fixed image
configure terminal
 boot system flash:<fixed-image>.bin
 end
write memory

! 6. Reload during a maintenance window
reload

On IOS XE platforms that run in install mode rather than bundle mode, use the install workflow instead of editing the boot variable directly:

install add file flash:<fixed-image>.bin activate commit

Remote upgrade runbook

Run this from a management workstation that can reach the device over SSH and reach a file server for the image. It backs up the running config off-box, copies the Cisco-verified fixed image, sets the boot variable, and reloads. Replace <fixed-image> with the build Cisco lists for your release.

#!/usr/bin/env bash
# CVE-2018-0172, Cisco IOS / IOS XE DHCP relay DoS upgrade runbook
# Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1

set -euo pipefail
DEVICE="${1:?usage: $0   }"
IMAGE="${2:?Cisco-verified fixed image filename required}"
SRV="${3:?file server ip required}"
LOG="/var/log/cve-2018-0172-$(date +%Y%m%d-%H%M%S).log"

echo "[1/4] Backing up config and recording current release from $DEVICE"
ssh admin@"$DEVICE" "show version | include (Version|IOS)" | tee -a "$LOG"
ssh admin@"$DEVICE" "copy running-config tftp://$SRV/cve-2018-0172-pre.cfg"

echo "[2/4] Copying fixed image $IMAGE to flash and verifying its hash"
ssh admin@"$DEVICE" "copy tftp://$SRV/$IMAGE flash:$IMAGE" | tee -a "$LOG"
ssh admin@"$DEVICE" "verify /md5 flash:$IMAGE" | tee -a "$LOG"

echo "[3/4] Setting boot image and reloading"
ssh admin@"$DEVICE" "configure terminal
 boot system flash:$IMAGE
 end
 write memory
 reload" | tee -a "$LOG"

echo "[4/4] Wait for reload, then confirm the running release"
sleep 300
ssh admin@"$DEVICE" "show version | include (Version|IOS)" | tee -a "$LOG"
echo "Confirm the reported build matches the Cisco first-fixed release for your train."

If you can't patch immediately

If you cannot schedule the upgrade today, reduce who can reach the DHCP service on the device. None of these remove the bug; they shrink the attack surface until you can reload onto a fixed image. Cisco notes there is no workaround that fully addresses the vulnerability, so treat these as stop-gaps only.

Limit which relays can reach the device

The crash is triggered by crafted DHCPv4 packets arriving from a relay path. If the device only needs to accept DHCP traffic from a known set of relay agents or server subnets, apply an infrastructure ACL on the receiving interfaces so spoofed DHCP packets from elsewhere never reach the option 82 code:

configure terminal
ip access-list extended PROTECT-DHCP
 ! permit DHCP only from your trusted DHCP server / relay subnet
 permit udp 10.20.0.0 0.0.0.255 any eq bootps
 permit udp 10.20.0.0 0.0.0.255 any eq bootpc
 ! drop and log DHCP from anywhere else, then permit the rest of traffic
 deny   udp any any eq bootps log
 deny   udp any any eq bootpc log
 permit ip  any any
exit
interface GigabitEthernet0/1
 ip access-group PROTECT-DHCP in
end
write memory

Rate-limit DHCP to the control plane

Control plane policing caps how fast crafted DHCP packets can be punted to the CPU, which slows a flood-style attempt while you stage the upgrade:

configure terminal
ip access-list extended COPP-DHCP
 permit udp any any eq bootps
 permit udp any any eq bootpc
class-map match-all CM-DHCP
 match access-group name COPP-DHCP
policy-map PM-COPP
 class CM-DHCP
  police 8000 conform-action transmit exceed-action drop
control-plane
 service-policy input PM-COPP
end
write memory

How to verify the fix worked

After the device reloads, confirm it is running the Cisco-listed fixed image and is stable:

# Confirm the running release and the active boot image
show version | include (Version|System image|IOS)
show bootvar

# Confirm the box reloaded cleanly and stayed up (no crash loop)
show version | include uptime
show logging | include (CRASH|RELOAD|%SYS-5-RESTART)

Expected result: the reported IOS / IOS XE build matches the first-fixed release Cisco lists for your train in cisco-sa-20180328-dhcpr1, and the device shows a fresh, stable uptime with no repeated reloads. If DHCP relay is still in use, send a normal DHCP request through the relay path and confirm clients still get leases. The fix corrects option 82 handling without changing legitimate relay behavior.

Frequently asked questions

Is CVE-2018-0172 remote code execution?

No. Despite the heap overflow, this CVE is a denial of service only. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H: confidentiality and integrity impact are NONE, availability is HIGH. A crafted DHCPv4 packet makes the device reload; Cisco did not document code execution or privilege escalation for this flaw. The damage is an outage, which a repeated packet turns into a sustained one.

Am I affected if I do not run DHCP relay?

The vulnerable code is the DHCP relay agent option 82 path. If no interface has an ip helper-address and DHCP relay information options are not configured, that code path is not in use. Confirm with show running-config | include ip helper-address and show running-config | include ip dhcp relay information. If both are empty, your exposure to this specific CVE is far lower, but still upgrade, because the same advisory may list other fixes for your train.

Which version do I upgrade to?

Cisco did not assign one global fixed version to this CVE. The first-fixed build depends on your release train and platform, and the only authoritative list is the Cisco IOS Software Checker on advisory cisco-sa-20180328-dhcpr1. Enter your exact running release there to get the correct target image. Do not guess a version number.

Why is this still important in 2026?

CISA added CVE-2018-0172 to the Known Exploited Vulnerabilities catalog on 2022-03-03, with a federal remediation deadline of 2022-03-17. KEV listing means real attackers have used it, so any unpatched IOS or IOS XE device running DHCP relay is a live target regardless of how old the CVE is. Cisco IOS images linger in production for years, which is exactly why this one stays relevant.

Is CVE-2018-0172 actually being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03 with a federal remediation deadline of 2022-03-17, which confirms real-world exploitation. Treat an unpatched IOS or IOS XE device running DHCP relay as a live target.

Do I need to reload the device after upgrading?

Yes. The fix is a new IOS / IOS XE image, and the device must reload to boot it. Schedule a maintenance window: in bundle mode set the boot variable and reload; in IOS XE install mode use install add file flash:<fixed-image>.bin activate commit. There is no hot-patch for this CVE.

What is the CVSS score and what does it tell me?

8.6 (High), vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. The scope is Changed and only availability is impacted, which confirms this is a denial-of-service flaw: an unauthenticated remote attacker can crash the device, but cannot read data or run code through it.

Where is the official advisory?

Cisco advisory cisco-sa-20180328-dhcpr1 is authoritative for affected releases and first-fixed builds; use its Software Checker for your exact version. The CISA KEV catalog and the References section below carry the remediation mandate and supporting sources.

References

• Official vendor advisory: https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-0172
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.tenable.com/security/research/tra-2018-06
• http://www.securitytracker.com/id/1040591
• http://www.securityfocus.com/bid/103552
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2018-0156: Cwe-399 in Cisco IOS and IOS XE
• How to Fix CVE-2018-13374: Incorrect Permission Assignment for Critical Resource in Fortinet Fortios, Fortiadc
• How to Fix CVE-2018-0171: Improper Input Validation in Cisco IOS and IOS XE
• How to Fix CVE-2018-0179: Cwe-399 in Cisco IOS
• How to Fix CVE-2018-0175: Buffer overflow in Cisco IOS, IOS XE, and IOS XR