Denial-of-Service in Cisco Catalyst 4500/4500‑X Switches (CVE‑2018‑0155) BFD Offload Vulnerability
What It Is – Cisco disclosed CVE‑2018‑0155, a flaw in the Bidirectional Forwarding Detection (BFD) offload implementation of Catalyst 4500 and Catalyst 4500‑X series switches. An unauthenticated, remote attacker can trigger a crash of the iosd process, rendering the switch unavailable.
Exploitability – The vulnerability is publicly known; proof‑of‑concept packets have been shared. CVSS v3.1 base score is 7.5 (High). No public exploit kits are known, but the attack requires only network‑level access to the switch.
Affected Products – Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500‑X Series Switches (all software releases prior to the Cisco security advisory patch).
Why It Matters for Trust & Control Assurance
- Availability controls – A DoS on core switching hardware directly tests the control objective of maintaining continuous service availability and resilience.
- Patch management evidence – Demonstrating timely application of vendor patches is a key piece of audit‑ready evidence across frameworks (e.g., NIST CSF, ISO 27001).
- Continuous monitoring – Ongoing health checks of critical processes (
iosd) and configuration baselines provide defensible proof that controls are operating as intended.
Recommended Actions
- Apply Cisco’s security advisory patch for the affected Catalyst models without delay.
- If BFD offload is not required, disable the feature to reduce the attack surface.
- Deploy continuous monitoring of the
iosdprocess and firmware versions across all switches. - Record patch status and monitoring logs as evidence for control‑assurance audits.
Source: CISA KEV – CVE‑2018‑0155