CASCACascade Atlas

Evidence dossier

CVE-2018-0155

A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could…

Exploited in the wild (CISA KEV since Mar 3, 2022). NVD reports CVSS 3.1 8.6. EPSS estimates 7.8% exploit likelihood as of Aug 27, 2026.

70.6–71.9Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.

State
PUBLISHED
Published
Mar 28, 2018
Updated
Jan 12, 2026
Evidence coverage
97%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    cisco

    Record text: A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.

    Inspect raw assertion
    Field
    container
    Value
    A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 7.79% probability · 94.21th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.077930000000; percentile 0.942120000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Mar 3, 2022 · first observed Jul 19, 2026

Exploit likelihood7.79%

FIRST EPSS · score date Aug 27, 2026 · 94.2th percentile · first observed Aug 27, 2026

SeverityCVSS 8.6

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Aug 27, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Aug 27, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
ciscoOriginal assertion
Record text

A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.

Inspect raw assertion
Field
container
Value
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system. This vulnerability affects Catalyst 4500 Supervisor Engine 6-E (K5), Catalyst 4500 Supervisor Engine 6L-E (K10), Catalyst 4500 Supervisor Engine 7-E (K10), Catalyst 4500 Supervisor Engine 7L-E (K10), Catalyst 4500E Supervisor Engine 8-E (K10), Catalyst 4500E Supervisor Engine 8L-E (K10), Catalyst 4500E Supervisor Engine 9-E (K10), Catalyst 4500-X Series Switches (K10), Catalyst 4900M Switch (K5), Catalyst 4948E Ethernet Switch (K5). Cisco Bug IDs: CSCvc40729.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

7.79% probability · 94.21th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.077930000000; percentile 0.942120000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
15Underlying assertions
13Canonical products
4Target assertions
11Constraint assertions

Grouped from 4 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

14 scope groups

cisco · source assertedn/aCisco IOS and IOS XEDirect source scope
Affected: Cisco IOS and IOS XE
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "Cisco IOS and IOS XE"}]
NVD CPE · HARDWAREciscocatalyst_4500e_supervisor_engine_8-e_(k10)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-a5db18c7f39dcbac491a78a83fe1a080c65fa40d4a1e47e4907e48796d9fd740Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4500e_supervisor_engine_8-e_\(k10\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    663dcb07-f6b6-4dc6-8373-742a7c117e44
NVD CPE · HARDWAREciscocatalyst_4500e_supervisor_engine_8l-e_(k10)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-3549e8a9850e2dd00904b2ad49b3adf7287af3b01f6e9a279f111233053c26a0Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4500e_supervisor_engine_8l-e_\(k10\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    229df042-cef2-4d1e-9197-3656919bf917
NVD CPE · HARDWAREciscocatalyst_4500e_supervisor_engine_9-e_(k10)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-03c38324083640c6f9f31d04095c7909ceca4654f1b26a4715494d02914a0705Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4500e_supervisor_engine_9-e_\(k10\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d8f261dc-26e4-48dc-a900-c41bf6cb4557
NVD CPE · HARDWAREciscocatalyst_4500_supervisor_engine_6-e_(k5)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-6921e840cd8a57d04fd0b6f31934328d7e1fc9f567cff622fb5f931ffaa3d422Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_6-e_\(k5\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d0c6a995-0878-49e6-b314-2278c8eb0e7e
NVD CPE · HARDWAREciscocatalyst_4500_supervisor_engine_6l-e_(k10)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-4f63319aeb17552cf457c78ba26c2fe15b5d426b2588c78c44230cbee53ddf30Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_6l-e_\(k10\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    06bf802c-c57a-402c-8ec2-e6176cb0ff86
NVD CPE · HARDWAREciscocatalyst_4500_supervisor_engine_7-e_(k10)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-d5f54541ef4663b951cc7dcb7da683bdac014de811e7094f0863a8f09546b846Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_7-e_\(k10\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9832b73c-116d-4f81-9de8-1ba930648e3f
NVD CPE · HARDWAREciscocatalyst_4500_supervisor_engine_7l-e_(k10)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-a3a5dc4166f916486a95abf06b6d02535f7dc3ad42cec5025667602345ec14d3Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4500_supervisor_engine_7l-e_\(k10\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    43ab5e31-8d8f-4009-9d6d-23c03ec9319a
NVD CPE · HARDWAREciscocatalyst_4500-x_series_switches_(k10)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-05976f8c912c2005afbfc460318de62afc8380a3827fc0a067c9171c287cf5b3Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4500-x_series_switches_\(k10\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d720b575-15f7-49ca-aa2f-8594982df9a0
NVD CPE · HARDWAREciscocatalyst_4900m_switch_(k5)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-72dc6c3fc98ec744f3e06344ccd5d22cea28503149d54d2db0889ae59687558aLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4900m_switch_\(k5\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cf434413-83d7-4d41-b9bf-4df258b491e0
NVD CPE · HARDWAREciscocatalyst_4948e_ethernet_switch_(k5)Environmental constraint · 1 assertions
Version not applicableCanonical identity product-33faefa2843b6547add675ac5709a70ff114387739a1093cbd1b7fa80c285bf5Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_4948e_ethernet_switch_\(k5\):-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bc27ef7d-924d-493c-b3c3-ac17ee9e5d44
NVD CPE · OPERATING SYSTEMciscoiosVulnerable target · 2 assertions
Version 3.6(2)eCanonical identity product-5972f4392170d0d1b4e75a10eb3b383835ead601c8d9b09329525407a4e1471aLinked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:cisco:ios:3.6\(2\)e:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3acd48ae-b818-40ce-848b-90b9bf1d4255
  2. cpe:2.3:o:cisco:ios:3.6\(2\)e:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3acd48ae-b818-40ce-848b-90b9bf1d4255
NVD CPE · OPERATING SYSTEMciscoios_xeVulnerable target · 2 assertions
Version 3.6(2)eCanonical identity product-cc06181059d0f387414dd5737700c03a38fe93d65d4a541ac9744a37c25c9f59Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:cisco:ios_xe:3.6\(2\)e:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0d9506fb-b290-44af-80a1-f698bec3cbc0
  2. cpe:2.3:o:cisco:ios_xe:3.6\(2\)e:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0d9506fb-b290-44af-80a1-f698bec3cbc0
NVD CPE · HARDWARErockwellautomationallen-bradley_stratix_8300_industrial_managed_ethernet_switchEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-1cde5dd9558a97a7df4b6b7bed621863020b8f6541348ab671d873b8ae3fff14Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:rockwellautomation:allen-bradley_stratix_8300_industrial_managed_ethernet_switch:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e96ae552-abc5-4101-acf6-b7f20ffb4043

Affected-product evidence

Accepted scope and product mapping

2 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-0774b265c0e837e737aaf99ed0f2450c048e61f34267ca59d8623878b839334e · product-5972f4392170d0d1b4e75a10eb3b383835ead601c8d9b09329525407a4e1471a

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
a74da326-5c71-4c24-825f-48b3c46da972e28604d8-fee6-4d74-bd05-60e9738992c5
Mapping establishedEvidence supported

vendor-0774b265c0e837e737aaf99ed0f2450c048e61f34267ca59d8623878b839334e · product-cc06181059d0f387414dd5737700c03a38fe93d65d4a541ac9744a37c25c9f59

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
4269a6f6-f0d0-43ec-ba1a-af1aa3b9641e66235c75-ff70-4aac-ae4f-870e437b77d1
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
939e7b88-2c3c-48d3-b374-b977b1651241

Assessments

CVSS by origin

8.6
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
7.8
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:L/Au:N/C:N/I:N/A:C
8.6
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Direct CVE/CNA normalized decisions

8.6Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Validation
Valid match
Recomputed
8.6
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.