CVE-2018-0175

What is LLDP on Cisco IOS/IOS XE/IOS XR?

Link Layer Discovery Protocol (LLDP) lets network devices automatically advertise their identity and capabilities to directly connected neighbors, supporting automatic topology discovery in management tools. It is processed by the device's control-plane software on every LLDP-enabled interface and is often enabled by default across Cisco's IOS product families.

Overview

CVE-2018-0175 is a high-severity format string vulnerability in the LLDP subsystem shared across Cisco IOS, IOS XE, and IOS XR Software. An unauthenticated attacker on an adjacent network segment can send a crafted LLDP frame containing attacker-controlled format-string sequences, which the device passes to a formatting function without proper sanitization, resulting in a denial-of-service condition or, more seriously, arbitrary code execution with elevated privileges. Unlike its companion buffer overflow CVE-2018-0167, this bug's CVSS vector notes user interaction is required, suggesting a somewhat narrower triggering condition.

Technical Details

The flaw is classified under CWE-119 (memory buffer bounds) in this catalog's records, though format string bugs are technically a distinct pattern (commonly CWE-134) where attacker-supplied input is passed directly as, or embedded within, a format specifier string to a function like a C-style printf variant. When that happens, format specifiers embedded in the attacker's data (e.g., %x, %n) can be used to read or write arbitrary memory locations, which is a far more powerful primitive than a typical buffer overflow and can lead directly to code execution.

Discovery

Cisco identified and fixed the issue internally, releasing it as part of the March 2018 semiannual IOS/IOS XE/IOS XR security advisory bundle alongside the related LLDP buffer overflow vulnerability, CVE-2018-0167.

Exploitation Context

CISA's KEV catalog listing confirms real-world exploitation of this vulnerability. As with other LLDP-related flaws from this disclosure batch, exploitation requires an attacker to have reached an adjacent network segment first — typically via a prior foothold on the same VLAN or physical segment — after which this bug offers a path to elevated code execution on core switching or routing infrastructure rather than just the originally compromised endpoint.

Remediation

1. Identify Cisco IOS, IOS XE, and IOS XR devices with LLDP enabled and confirm their current software version.
2. Apply the Cisco-published fixed software release from the corresponding security advisory.
3. Disable LLDP on interfaces facing untrusted or lower-trust segments where automatic neighbor discovery is not required.
4. Segment untrusted devices away from core network infrastructure to limit adjacent-network attack opportunities.
5. Monitor for unexpected crashes or anomalous behavior on LLDP-enabled interfaces, which could indicate exploitation attempts.