CVE-2018-0175
Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.
Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- securityfocus.com/bid/103564Broken LinkThird Party Advisory
- securitytracker.com/id/1040586Broken LinkThird Party Advisory
- ics-cert.us-cert.gov/advisories/ICSA-18-107-03Third Party AdvisoryUS Government Resource
- ics-cert.us-cert.gov/advisories/ICSA-18-107-04Third Party AdvisoryUS Government Resource
- ics-cert.us-cert.gov/advisories/ICSA-18-107-05Third Party AdvisoryUS Government Resource
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldpVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0175US Government Resource
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1685 days
- CVSS
- 8.0 HIGH
- EPSS (30-day exploit probability)
- 3.5% · top 11% of all CVEs
- Weakness
- CWE-119
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.