CVE-2018-0167

LLDP is a simple “who’s connected to the network” announcement used by network devices. This bug is like a bad input handling problem in that announcement system: a nearby attacker can send crafted network traffic that makes the device crash, or in the worst case, run hostile code at very high privilege.

Think of it as someone slipping a malformed message into your network device’s “handshake” so the device can’t handle it correctly—potentially taking the whole network equipment offline.

This matters if your business runs Cisco network infrastructure using cisco ios, cisco ios xe, or cisco ios xr and those devices are reachable from other machines on the local network where someone you don’t trust could be present. The flaw does not require a login or user action.

Because the attack is “adjacent network,” treat it as a risk when an attacker could send traffic on the same network segment as the device (and especially where LLDP is enabled on interfaces).

This is RED because it’s confirmed in the CISA KEV catalog, meaning it has been tied to real-world risk and requires remediation. The bug can be triggered without authentication from the adjacent network, so exposure doesn’t depend on having stolen credentials.

Act urgently to remove the vulnerable software exposure path on any affected Cisco devices you run.