Cisco Smart Install unauthenticated RCE in IOS and IOS XE
Unauthenticated remote code execution in the Cisco Smart Install client on IOS and IOS XE. Patched by Cisco in March 2018 and still the primary access vector FSB Centre 16 uses against edge routers on critical-infrastructure networks per a July 2026 joint advisory.
- Vendor
- Cisco
- Product
- IOS and IOS XE with Smart Install client enabled
- CVSS
- 9.8
- EPSS (exploit probability)
- 99.5%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2018-0171 being exploited?
Yes. CISA added CVE-2018-0171 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 99.5% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (181 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
A stack-based buffer overflow in the Smart Install image list handler in Cisco IOS and IOS XE. Smart Install is a zero-touch provisioning protocol that speaks over TCP 4786; where the client is enabled, an unauthenticated attacker with reachability to that port can send a crafted message that reaches the vulnerable parsing path and triggers either remote code execution or a device reload.
Public exploitation pattern (per the July 2026 CSA — Improve Router Hygiene): the observed use of this bug at scale is not shellcode. Actors read the running config off the device over TFTP, harvest credentials (including local users and SNMP community strings), and re-enter the environment through the ordinary management path — often after modifying the config to keep persistence.
Cisco’s remediation is unchanged since 2018:
- Upgrade to a fixed release listed in cisco-sa-20180328-smi2.
- Where Smart Install is not in active use, disable it with
no vstackin configuration mode.show vstack configshows current state.
Ongoing exploitation:
- 2025-08 — FBI PSA (I-082025-PSA) attributes ongoing exploitation to FSB Centre 16 (Berserk Bear / Static Tundra), citing more than a thousand compromised Cisco devices.
- 2026-07-13 — Joint advisory co-signed by Australia, Canada, the Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, Sweden, the UK and the US calls out the same CVE and the same actor as the current router-hygiene priority for critical-infrastructure operators. CSA — Improve Router Hygiene (PDF) · NCSC coverage.
Other Cisco IOS and IOS XE CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2025-20352 Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability | [ HIGH ] | 7.7 | 41.5% | |
| CVE-2023-20109 Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | [ MEDIUM ] | 6.6 | 2.5% | |
| CVE-2017-6742 Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | [ HIGH ] | 8.8 | 21.4% | |
| CVE-2017-3881 Cisco IOS and IOS XE Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 99.0% | |
| CVE-2018-0173 Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | [ HIGH ] | 8.6 | 7.6% | |
| CVE-2018-0172 Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | [ HIGH ] | 8.6 | 7.8% | |
| CVE-2018-0159 Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability | [ HIGH ] | 7.5 | 6.9% | |
| CVE-2018-0158 Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability | [ HIGH ] | 8.6 | 7.2% |
