{"id":"CVE-2018-0155","kind":"vulnerability","aliases":["CVE-2018-0155"],"related":[],"title":"Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches: Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability","description":"A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.","summary":"A flaw in the BFD offload code of Cisco Catalyst 4500 and 4500-X switches lets an unauthenticated remote attacker crash the iosd process. The result is a denial of service that takes the switch's routing and forwarding down until it recovers.","severity":"high","cvss":8.6,"epss":0.07742,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["catalyst-4500","cisco","exploited","infrastructure","network-switch"],"not_affected_if":["bfd-offload-disabled","non-4500-platform"],"how_to_check":null,"fix":"Apply the update per Cisco's vendor advisory, as CISA requires. Target versions are unknown from these sources.","status":"open","published_at":"2018-03-28T22:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:24:16+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:24:16Z","model":"claude-haiku-5-5","output":{"fix":"Apply the update per Cisco's vendor advisory, as CISA requires. Target versions are unknown from these sources.","reach":"network","impact":"low","summary":"A flaw in the BFD offload code of Cisco Catalyst 4500 and 4500-X switches lets an unauthenticated remote attacker crash the iosd process. The result is a denial of service that takes the switch's routing and forwarding down until it recovers.","category":"infrastructure","who_cares":["cisco","catalyst-4500","network-switch"],"confidence":0.6,"needs_auth":"no","worst_case":"Switch iosd process crashes, causing network denial of service.","analyst_note":"Find the Cisco advisory for CVE-2018-0155 to get affected and fixed IOS XE versions and the BFD offload detection command; the sources do not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["bfd-offload-disabled","non-4500-platform"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000483,"input_tokens":2970,"output_tokens":373,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0155':25A,28A '-2018':24A,27A '-4500':42B '4500':3A,9A,31A,37A,59B,61B,105C,111C,190C,197C,205C,212C,242C '4500e':220C,227C,235C '4900m':248C '4948e':252C '6':193C '6l':201C '6l-e':200C '7':208C '7l':216C '7l-e':215C '8':223C '8l':231C '8l-e':230C '9':238C 'across':168C 'affect':170C,188C 'allow':116C,176C 'and':34A 'attack':68B,120C,155C,178C 'bfd':53B,99C,146C,150C,164C 'bidirect':15A,96C 'bug':257C 'catalyst':2A,8A,14A,30A,36A,41B,58B,104C,110C,189C,196C,204C,211C,219C,226C,234C,241C,247C,251C 'caus':122C,129C 'cisco':1A,7A,13A,29A,35A,43B,57B,103C,109C,256C 'code':55B 'condit':135C 'could':115C,156C,175C 'craft':163C 'crash':69B,124C 'cscvc40729':259C 'cve':23A,26A 'denial':19A,77B,131C 'denial-of-servic':18A 'detect':17A,98C 'dos':134C 'due':139C 'e':194C,202C,209C,217C,224C,232C,239C 'engin':192C,199C,207C,214C,222C,229C,237C 'error':142C 'ethernet':253C 'exploit':44B,157C,174C 'flaw':50B 'forward':16A,87B,97C 'handl':143C 'header':147C 'id':258C 'implement':101C 'incomplet':153C 'infrastructur':45B 'insuffici':141C 'iosd':71B,127C 'k10':203C,210C,218C,225C,233C,240C,246C 'k5':195C,250C,255C 'let':64B 'messag':165C 'network':47B 'network-switch':46B 'offload':54B,100C 'packet':151C 'process':72B,128C 'recov':91B 'reload':182C 'remot':67B,119C 'result':74B 'rout':85B 'send':161C 'seri':4A,11A,106C,113C,244C 'series':32A,39A 'servic':21A,79B,133C 'success':173C 'supervisor':191C,198C,206C,213C,221C,228C,236C 'switch':5A,12A,48B,63B,83B,107C,114C,171C,245C,249C,254C 'switches':33A,40A 'system':185C 'take':81B 'trigger':180C 'unauthent':66B,118C 'vulner':22A,93C,137C,159C,187C 'x':10A,38A,62B,112C,243C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-03-28T22:29:00+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-0155","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0155","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:25+00:00","note":null},{"source":"epss","external_id":"CVE-2018-0155","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-0155","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-0155","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0155","severity":null,"published_at":"2018-03-28T22:29:00+00:00","modified_at":"2026-06-17T01:29:57+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}