CVE-2018-0167

What is LLDP on Cisco IOS/IOS XE/IOS XR?

Link Layer Discovery Protocol (LLDP) is a vendor-neutral protocol devices use to advertise their identity, capabilities, and neighbors on a local segment, letting network management tools automatically build topology maps. It is enabled by default on many Cisco platforms and processed directly by the device's control-plane software on every LLDP-enabled interface, without requiring any authentication from the sending neighbor.

Overview

CVE-2018-0167 is a high-severity buffer overflow vulnerability in the LLDP subsystem shared across Cisco IOS, IOS XE, and IOS XR Software. An unauthenticated attacker on an adjacent network segment (i.e., able to send Layer 2 frames directly to the device, such as from within the same broadcast domain) can send a crafted LLDP frame that overflows a buffer in the parsing code, resulting in either a device crash or, potentially, arbitrary code execution.

Technical Details

The flaw is classified under CWE-119 (improper restriction of operations within the bounds of a memory buffer). Because LLDP frames are accepted and parsed automatically from any device on the local segment — by design, to support automatic neighbor discovery — the parser trusts fields such as length and type-length-value (TLV) content more than it should, and a crafted frame with malformed TLV data can write past the bounds of an allocated buffer. The Adjacent Network attack vector distinguishes this from fully remote bugs: an attacker must have Layer 2 reachability to the target interface, such as a foothold on the same VLAN or physical segment, rather than being able to attack across the internet.

Discovery

Cisco identified and fixed the issue internally, publishing it as part of the March 2018 semiannual IOS/IOS XE/IOS XR security advisory bundle alongside a related LLDP format-string vulnerability, CVE-2018-0175.

Exploitation Context

CISA's KEV catalog listing confirms this vulnerability has seen real-world exploitation. LLDP and other neighbor-discovery protocol bugs are particularly relevant in environments where an attacker has already gained a foothold on an internal segment — for example after phishing a workstation or compromising an IoT device on the same VLAN — since from that position they can pivot into the switching/routing infrastructure itself rather than merely the endpoint they first compromised.

Remediation

1. Identify Cisco IOS, IOS XE, and IOS XR devices with LLDP enabled and confirm their current software version.
2. Apply the Cisco-published fixed software release from the corresponding security advisory.
3. Disable LLDP on interfaces facing untrusted segments, end-user ports, or any location where automatic neighbor discovery is not operationally required.
4. Segment untrusted or less-trusted devices onto VLANs isolated from core switching/routing infrastructure.
5. Monitor for unexpected device crashes on interfaces with LLDP enabled, which could indicate exploitation attempts.