Exploited vulnerability · CISA KEV

Is CVE-2018-0171 exploited? Yes: in CISA KEV since 3 Nov 2021

Gociux · Cisco IOS and IOS XE · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2018-0171, Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, 1316 days after it was published. It affects Cisco IOS and IOS XE, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.

What to do

1. Check whether you run it. Look for IOS and IOS XE in your asset inventory, including appliances and cloud images. Stack check lists every exploited Cisco CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 28 Mar 2018.
4. Get told next time. Email alerts when CISA adds a CVE for Cisco.

Other exploited CVEs in IOS and IOS XE

• CVE-2025-20352: Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability (29 Sep 2025)
• CVE-2023-20109: Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability (10 Oct 2023)
• CVE-2017-3881: Cisco IOS and IOS XE Remote Code Execution Vulnerability (25 Mar 2022)

References

• nvd.nist.gov/vuln/detail/CVE-2018-0171

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in November 2021 · Cisco scorecard · act-now radar.