Is CVE-2018-0174 actively exploited?

Yes. CVE-2018-0174 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2018-0174 be exploited remotely?

The attack vector of CVE-2018-0174 has not been classified yet.

What is the CVSS score of CVE-2018-0174?

CVE-2018-0174 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2018-0174

HIGHCISA KEVIN THE WILD

CVE-2018-0174

Published: March 3, 2022

EPSS:4.07%probability of exploitation in 30 daysPercentile:88.3th

Official Description

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).

NVD Source

CISA KEV Advisory

Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).

Added to KEV: 2022-03-03Federal patch deadline: 2022-03-17

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This vulnerability in Cisco IOS Software and Cisco IOS XE Software's DHCP option 82 encapsulation functionality can lead to a denial-of-service condition. While a CVSS score is not available, its HIGH severity and inclusion in CISA's KEV catalog with an EPSS score of 0.04069 indicate a significant risk of exploitation.

This vulnerability is actively being exploited in the wild, as confirmed by its presence in CISA's KEV catalog. The exploit status indicates active exploitation.

Recommended Action

Update Cisco IOS Software and Cisco IOS XE Software to the latest patched versions. Implement network best practices to protect DHCP services and critical network infrastructure.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2018-0174 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2018-0174 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.