Vulnerabilities ›

CVE-2018-0155

Critical 🇺🇸 CISA KEV ⚡ Exploit Available

                    Published: Mar 3, 2022                                          ·  Source: CISA_KEV                

CVSS v3

9.0

🔗 NVD Official

📄 Description (English)

Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability — A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.

🤖 AI Executive Summary

CVE-2018-0155 is a critical denial-of-service vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 and 4500-X Series Switches. An unauthenticated remote attacker can crash the iosd process, causing a complete denial of service on affected network infrastructure. With a CVSS score of 9.0 and publicly available exploits, this vulnerability poses an immediate risk to organizations relying on these switches for core network operations. Although a patch has been available since 2018, unpatched legacy devices remain a significant concern.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Apr 9, 2026 11:01

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability directly impacts network infrastructure switches widely deployed across Saudi organizations. The banking sector (SAMA-regulated institutions), government entities (NCA-governed networks), telecom operators (STC, Mobily, Zain), energy companies (Saudi Aramco, SABIC, SEC), and healthcare organizations commonly use Cisco Catalyst 4500 series switches in their campus and data center networks. A successful exploit could disrupt critical network services, causing cascading failures in dependent systems. Saudi critical infrastructure relying on BFD for fast failover detection in routing protocols is particularly at risk, as the attack could disable both primary network paths and failover mechanisms simultaneously.

🏢 Affected Saudi Sectors

Banking Government Telecommunications Energy Healthcare Education Retail

⚖️ Saudi Risk Score (AI)

7.8

/ 10.0

🔧 Remediation Steps (English)

Immediate Actions:

1. Identify all Cisco Catalyst 4500 and 4500-X Series Switches in your environment using network inventory tools

2. Check current IOS versions against Cisco Security Advisory cisco-sa-20180328-bfd

3. Apply the vendor-provided patch immediately — upgrade to the fixed IOS/IOS-XE software version recommended by Cisco



Compensating Controls (if immediate patching is not possible):

1. Implement infrastructure ACLs (iACLs) to restrict BFD traffic to only trusted routing peers

2. Use Control Plane Policing (CoPP) to rate-limit BFD packets reaching the switch CPU

3. Segment network to limit exposure of management and routing protocol interfaces

4. Disable BFD on interfaces where it is not required



Detection Rules:

1. Monitor for unexpected iosd process crashes via syslog (look for %IOSXE-3-PLATFORM messages)

2. Configure SNMP traps for device reloads and process crashes

3. Deploy IDS/IPS signatures for anomalous BFD packet patterns

4. Monitor for unusual volumes of BFD traffic from untrusted sources

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تحديد جميع محولات Cisco Catalyst 4500 و4500-X في بيئتك باستخدام أدوات جرد الشبكة

2. التحقق من إصدارات IOS الحالية مقابل تحذير Cisco الأمني cisco-sa-20180328-bfd

3. تطبيق التصحيح المقدم من البائع فوراً — الترقية إلى إصدار برنامج IOS/IOS-XE الثابت الموصى به من Cisco



الضوابط التعويضية (إذا لم يكن التصحيح الفوري ممكناً):

1. تنفيذ قوائم التحكم في الوصول للبنية التحتية (iACLs) لتقييد حركة BFD على أقران التوجيه الموثوقين فقط

2. استخدام سياسة مستوى التحكم (CoPP) للحد من معدل حزم BFD التي تصل إلى معالج المحول

3. تقسيم الشبكة للحد من تعرض واجهات الإدارة وبروتوكولات التوجيه

4. تعطيل BFD على الواجهات التي لا تحتاج إليه



قواعد الكشف:

1. مراقبة أعطال عملية iosd غير المتوقعة عبر سجلات النظام

2. تكوين تنبيهات SNMP لإعادة تشغيل الأجهزة وأعطال العمليات

3. نشر توقيعات IDS/IPS لأنماط حزم BFD غير الطبيعية

4. مراقبة الأحجام غير العادية لحركة BFD من مصادر غير موثوقة

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2-3-1 (Network Security) ECC 2-5-1 (Vulnerability Management) ECC 2-3-4 (Infrastructure Protection) ECC 2-6-1 (Incident Management)

🔵 SAMA CSF

3.3.3 (Network Security Management) 3.3.4 (Infrastructure Security) 3.4.1 (Vulnerability Management) 3.3.7 (Denial of Service Protection)

🟡 ISO 27001:2022

A.8.9 (Configuration Management) A.8.8 (Management of Technical Vulnerabilities) A.8.20 (Networks Security) A.8.21 (Security of Network Services)

🟣 PCI DSS v4.0

Requirement 6.3.3 (Patching Critical Vulnerabilities) Requirement 1.2 (Network Security Controls) Requirement 11.4 (External and Internal Penetration Testing)

🔗 References & Sources 0

No references.

📦 Affected Products / CPE 1 entries

Cisco:Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches

📊 CVSS Score

9.0

/ 10.0 — Critical

📋 Quick Facts

Severity Critical

CVSS Score9.0

EPSS11.22%

Exploit ✓ Yes

Patch ✓ Yes

CISA KEV🇺🇸 Yes

KEV Due Date2022-03-17

Published 2022-03-03

Source Feed cisa_kev

🇸🇦 Saudi Risk Score

7.8

/ 10.0 — Saudi Risk

🏷️ Tags

kev actively-exploited

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2018-0155

Introduce Yourself

Sign In Required