CVE-2018-0155

CVE-2018-0155 is a denial-of-service flaw in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 and 4500-X series switches, caused by insufficient error handling when a BFD packet arrives with an incomplete BFD header. An unauthenticated, remote attacker can trigger it by sending a crafted BFD message directly to the switch or across it, which crashes the iosd process and reloads the system. A successful exploit gains no data compromise but inflicts a full availability outage (CVSS 3.1: 8.6, availability-high with changed scope), and repeated crafted packets can keep the device reloading. Only the listed Catalyst 4500 supervisor engines, 4500-X, 4900M and 4948E platforms running the affected IOS/IOS XE releases are affected; switches that never receive BFD traffic are far less exposed. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), meaning it is known to be exploited in the wild, though no public proof-of-concept is available and any ransomware association is unknown.

What to do: Inventory Catalyst 4500/4500E/4500-X/4900M/4948E devices (including all listed supervisor engines) and upgrade to a fixed IOS/IOS XE release per Cisco's advisory for Bug ID CSCvc40729, which is also CISA's required action for this KEV entry. Until patched, restrict BFD traffic to trusted routing adjacencies and filter untrusted BFD packets sent to or transiting the switch, and monitor for iosd crashes and unexpected device reloads. Prioritize remediation on devices reachable by untrusted networks, given the active-exploitation (KEV) status.