CVE-2018-0173

What is DHCP Option 82 on Cisco IOS/IOS XE?

DHCP option 82 (relay agent information) lets a switch acting as a DHCP relay tag client requests with identifying data, such as the physical port they arrived on, before forwarding them upstream to the DHCP server; the relay must later strip and restore that data correctly as replies flow back down to the client. This restore path is a distinct piece of code from the general encapsulation logic, and is the specific function affected here.

Overview

CVE-2018-0173 is a high-severity denial-of-service vulnerability in the function of Cisco IOS and IOS XE Software responsible for restoring encapsulated DHCP option 82 information in DHCPv4 packets. An unauthenticated, remote attacker who can send crafted DHCPv4 traffic to a device performing this restore function can trigger a fault leading to a denial-of-service condition.

Technical Details

The flaw is classified under CWE-20 (improper input validation). The DHCPv4 relay restore function reconstructs option 82 data that was stripped for transmission to the DHCP server, and does not adequately validate that reconstructed data before further processing, allowing a malformed packet to drive the function into an unexpected state. As with other bugs in this family, no authentication is required — only network reachability to the relay-processing device.

Discovery

Cisco identified and fixed the issue internally, releasing it as part of the March 2018 semiannual IOS/IOS XE security advisory bundle alongside two closely related DHCP option 82 vulnerabilities, CVE-2018-0172 and CVE-2018-0174.

Exploitation Context

CISA's KEV catalog listing confirms this vulnerability has been exploited in the wild. As with the related option 82 bugs disclosed in the same batch, this flaw threatens availability of DHCP-based address assignment across access-layer network segments, an outcome attractive to attackers seeking broad network disruption with a low-effort, low-privilege attack.

Remediation

1. Identify Cisco IOS/IOS XE devices configured as DHCP relay agents with option 82 enabled.
2. Apply the Cisco-published fixed software release from the corresponding security advisory.
3. Use DHCP snooping and port security to limit which sources can send DHCP traffic through relay-configured interfaces.
4. Monitor affected devices for unexpected reloads or crashes tied to DHCP relay processing.
5. Coordinate patching of this vulnerability together with CVE-2018-0172 and CVE-2018-0174, since all three were fixed in the same software release train.