CVE-2018-0161

What is SNMP on Cisco Catalyst Switches?

SNMP (Simple Network Management Protocol) is used across virtually all enterprise network gear to allow monitoring platforms to poll device statistics and, in some configurations, push configuration changes. On Cisco Catalyst switches it typically requires a valid community string or SNMPv3 credentials, which is why this bug is rated authenticated rather than fully unauthenticated — though SNMP community strings are frequently weak, default, or reused across an organization's device fleet.

Overview

CVE-2018-0161 is a medium-severity denial-of-service vulnerability in the SNMP subsystem of Cisco IOS Software on certain Catalyst switch models. An authenticated, remote attacker who can send SNMP requests to an affected switch can trigger a resource-management fault that causes the device to crash and reload, disrupting the traffic it forwards.

Technical Details

The vulnerability is classified under CWE-399 (resource management errors): certain SNMP request patterns are not handled correctly by the switch's SNMP agent, leading to abnormal resource consumption or an invalid state that forces a reload. The CVSS vector reflects high attack complexity and a requirement for low-privilege authentication, consistent with SNMP's design — an attacker must possess a working community string (or SNMPv3 credential) and craft a request that reliably triggers the fault.

Discovery

Cisco identified and fixed the issue internally as part of the March 2018 semiannual IOS security advisory bundle.

Exploitation Context

CISA's KEV listing confirms this vulnerability has been exploited in real-world attacks. SNMP-based attacks on network infrastructure often follow an initial compromise or credential-harvesting step elsewhere in the environment — once an attacker has obtained a working SNMP community string (frequently through weak defaults like "public"/"private" or credential reuse), this class of bug offers a straightforward way to disrupt switching infrastructure.

Remediation

1. Identify Catalyst switches running affected IOS versions with SNMP enabled.
2. Apply the Cisco-published fixed software release from the corresponding security advisory.
3. Replace default or weak SNMP community strings with strong, unique values, and migrate to SNMPv3 with authentication and encryption where possible.
4. Restrict SNMP access to a dedicated management network reachable only from trusted monitoring hosts.
5. Monitor for unexpected switch reloads correlated with SNMP polling activity.