VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 06:30 UTC

CVE-2018-0171

Read full description

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.

CVSS 7.5 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.6/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.5: +1.12
Fresh EPSS: 99.48%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 19 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Cybersecurity Dive

Press · 13 Jul 2026, 07:00 · US authorities warn that state-linked hackers are targeting vulnerable networking devices - Cybersecurity Dive

BleepingComputer

Press · 21 Aug 2025, 07:00 · FBI warns of Russian hackers exploiting 7-year-old Cisco flaw - BleepingComputer

Help Net Security

Press · 21 Aug 2025, 07:00 · Russian threat actors using old Cisco bug to target critical infrastructure orgs - Help Net Security

Security Affairs

Press · 21 Aug 2025, 07:00 · FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage - Security Affairs

Cyber Security Agency of Singapore

Press · 21 Aug 2025, 07:00 · Active Exploitation of Cisco Smart Install Client Vulnerability - Cyber Security Agency of Singapore

See all 19 source documents

Infosecurity Magazine

Press · 21 Aug 2025, 07:00 · Russian Espionage Group Static Tundra Targets Legacy Cisco Flaw - Infosecurity Magazine

SecurityWeek

Press · 21 Aug 2025, 07:00 · Russian APT Exploiting 7-Year-Old Cisco Vulnerability: FBI - SecurityWeek

CSO Online

Press · 21 Aug 2025, 07:00 · Russian hackers exploit old Cisco flaw to target global enterprise networks - CSO Online

CyberScoop

Press · 20 Aug 2025, 07:00 · Russian cyber group exploits seven-year-old network vulnerabilities for long-term espionage - CyberScoop

Cisco Talos Blog

Press · 20 Aug 2025, 07:00 · Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices - Cisco Talos Blog

The Register

Press · 20 Aug 2025, 07:00 · FBI: Russian spies exploiting a 7-year-old Cisco bug to slurp configs from critical infrastructure - The Register

The Hacker News

Press · 20 Aug 2025, 07:00 · FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage - The Hacker News

Cybersecurity Dive

Press · 25 Feb 2025, 08:00 · Attackers exploiting Cisco vulnerabilities tied to Salt Typhoon campaign - Cybersecurity Dive

Security Magazine

Press · 25 Feb 2025, 08:00 · 7-year-old vulnerability exploited in Salt Typhoon attack - Security Magazine

GreyNoise

Press · 24 Feb 2025, 08:00 · GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks - GreyNoise

The Hacker News

Press · 21 Feb 2025, 08:00 · Cisco Confirms Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks - The Hacker News

SecurityWeek

Press · 05 Apr 2018, 07:00 · Unprotected Switches Expose Critical Infrastructure to Attacks: Cisco - SecurityWeek

The Hacker News

Press · 04 Apr 2018, 07:00 · Critical flaw leaves thousands of Cisco Switches vulnerable to remote hacking - The Hacker News

Security Affairs

Press · 29 Mar 2018, 07:00 · CISCO addresses two critical remote code execution flaws in IOS XE operating system - Security Affairs

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.6 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Source entries and unverified repository candidates are counted separately.

Public exploit evidence

exploitdb #44451 2018-03-29

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.5; EPSS 99.5%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:54.561888+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

28 Mar 2018, 22:00

First press mention

29 Mar 2018, 07:00

Added to the CISA KEV catalog

03 Nov 2021, 00:00

Latest press mention

13 Jul 2026, 07:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

1 repositories