CVE-2018-0173

CVE-2018-0173 is an improper input validation flaw (CWE-20) in the Cisco IOS and IOS XE code path that restores encapsulated DHCP option 82 (Relay Agent Information) data in DHCPv4 packets. An unauthenticated, remote attacker can trigger it by sending a crafted DHCPv4 packet to a device acting as a DHCP relay; when the device forwards it to a DHCPv4 server and then processes the option 82 information encapsulated in the server's DHCPOFFER response, a processing error occurs. A successful exploit causes the affected device to reload, producing a Relay Reply denial-of-service condition — no confidentiality or integrity impact, but complete loss of availability on that device (CVSS 3.1 8.6, scope-changed, availability-high). Any Cisco IOS or IOS XE device with the DHCPv4 relay/option 82 feature in the data path is affected; the source data does not specify affected release ranges, so administrators must consult Cisco's advisory (Bug ID CSCvg62754, CNA: [email protected]) for their train. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03 (ransomware use unknown, required action: apply vendor updates), EPSS estimates a 7.6% probability of exploitation in the next 30 days (94th percentile), and no public proof-of-concept is known.

What to do: Inventory IOS/IOS XE devices configured for DHCPv4 relay (check for 'ip helper-address' / 'ip dhcp relay information option' in the running config and confirm the release with 'show version'), then upgrade to the fixed releases listed in Cisco's advisory for Bug ID CSCvg62754. If patching must wait, use interface ACLs to prevent untrusted hosts from sending DHCP packets to relay interfaces, since exploitation requires no credentials or user interaction. The CISA KEV entry (added 2022-03-03) mandates applying the vendor updates, so prioritize internet-facing and site-gateway relay devices.