CVE-2018-0172
Quick assessment
Affected
n/a Cisco IOS and IOS XE
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco IOS Software和IOS XE Software都是美国思科（Cisco）公司为其网络设备开发的操作系统。 Cisco IOS Software和IOS XE Software中的DHCP option 82 encapsulation功能存在输入验证漏洞，该漏洞源于程序没有对option 82信息执行完整的输入校验。远程攻击者可通过发送特制的DHCPv4数据包利用该漏洞造成拒绝服务（设备重新加载）。
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1135 · Network Share Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-0172
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow condition on the affected device, which will cause the device to reload and result in a DoS condition. Cisco Bug IDs: CSCvg62730.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco IOS Software和IOS XE Software 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco IOS Software和IOS XE Software都是美国思科（Cisco）公司为其网络设备开发的操作系统。 Cisco IOS Software和IOS XE Software中的DHCP option 82 encapsulation功能存在输入验证漏洞，该漏洞源于程序没有对option 82信息执行完整的输入校验。远程攻击者可通过发送特制的DHCPv4数据包利用该漏洞造成拒绝服务（设备重新加载）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Cisco IOS and IOS XE | Cisco IOS and IOS XE | - |
|
II. Public POCs for CVE-2018-0172
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-0172
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-0172 (3)
Other References for CVE-2018-0172 (3)
-
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-05 x_refsource_MISC
-
https://www.tenable.com/security/research/tra-2018-06 x_refsource_MISC
-
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-04 x_refsource_MISC
Same Patch Batch · n/a · 2018-03-28 · 46 CVEs total
| CVE-2018-0190 | Cisco IOS XE Software 跨站脚本漏洞 | |
| CVE-2018-0196 | Cisco IOS XE Software 输入验证错误漏洞 | |
| CVE-2018-8820 | Square 9 GlobalForms SQL注入漏洞 | |
| CVE-2018-9109 | Studio 42 elFinder 路径遍历漏洞 | |
| CVE-2018-9106 | Joomla! Acyba AcySMS扩展输入验证错误漏洞 | |
| CVE-2018-9107 | Joomla! Acyba AcyMailing扩展输入验证错误漏洞 | |
| CVE-2018-9108 | QuickAppsCMS 跨站请求伪造漏洞 | |
| CVE-2018-8823 | PrestaShop Responsive Mega Menu Pro模块安全漏洞 | |
| CVE-2018-9110 | Studio 42 elFinder on Windows 安全漏洞 | |
| CVE-2018-0193 | Cisco IOS XE Software CLI解析器命令注入漏洞 | |
| CVE-2018-0195 | Cisco IOS XE Software REST API 授权问题漏洞 | |
| CVE-2018-0189 | Cisco IOS Software和IOS XE Software 资源管理错误漏洞 | |
| CVE-2018-0188 | Cisco IOS XE Software 跨站脚本漏洞 | |
| CVE-2018-0186 | Cisco IOS XE Software 跨站脚本漏洞 | |
| CVE-2018-0185 | Cisco IOS XE Software CLI解析器命令注入漏洞 | |
| CVE-2018-0184 | Cisco IOS XE Software CLI解析器权限许可和访问控制漏洞 | |
| CVE-2018-0183 | Cisco 4000 Series Integrated Services Router IOS XE Software CLI解析器权限许可和访问控制漏洞 | |
| CVE-2018-0182 | Cisco IOS XE Software CLI解析器命令注入漏洞 | |
| CVE-2018-0180 | Cisco IOS Software 资源管理错误漏洞 | |
| CVE-2018-0179 | Cisco IOS Software 资源管理错误漏洞 |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Cisco IOS and IOS XE
-
CVE-2018-0156
Cisco IOS Software和IOS XE Software 资源管理错误漏洞 -
CVE-2018-0158
Cisco IOS Software和IOS XE Software Internet Key Exchange Ver -
CVE-2018-0155
Cisco Catalyst 4500 Series Switches 代码问题漏洞 -
CVE-2018-0159
Cisco IOS Software和IOS XE Software 输入验证漏洞 -
CVE-2018-0189
Cisco IOS Software和IOS XE Software 资源管理错误漏洞
Same vendor: n/a
-
CVE-2026-105156
YzmCMS MD5 system.func.php password weak password hash -
CVE-2026-105149
mooSocial all-products sql injection -
CVE-2026-105144
Drogon Static File Router StaticFileRouter.cc route path tra -
CVE-2026-105137
Laradock Build Process Dockerfile code download -
CVE-2026-51906
TaskingAI v0.3.0 DALL-E 3目录遍历漏洞
Same weakness: CWE-20
-
CVE-2026-105117
OpenAM before 16.1.3 Email Content Injection via Users REST -
CVE-2026-63569
MTI/A0 DHAgreement does not validate the peer's ephemeral va -
CVE-2026-55094
Taskcluster: Unauthenticated remote code execution in `web-s -
CVE-2026-47547
NVIDIA驱动固件输入验证漏洞致代码执行 -
CVE-2026-47546
NVIDIA驱动固件输入验证漏洞致代码执行
V. Comments for CVE-2018-0172
No comments yet