CASCACascade Atlas

Evidence dossier

CVE-2018-0156

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected…

Exploited in the wild (CISA KEV since Mar 3, 2022). NVD reports CVSS 3.1 7.5. EPSS estimates 8.2% exploit likelihood as of Aug 27, 2026.

68.0–69.3Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

State
PUBLISHED
Published
Mar 28, 2018
Updated
Jan 12, 2026
Evidence coverage
97%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    cisco

    Record text: A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

    Inspect raw assertion
    Field
    container
    Value
    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 8.2% probability · 94.45th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.081950000000; percentile 0.944530000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Mar 3, 2022 · first observed Jul 19, 2026

Exploit likelihood8.20%

FIRST EPSS · score date Aug 27, 2026 · 94.5th percentile · first observed Aug 27, 2026

SeverityCVSS 7.5

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Aug 27, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Aug 27, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
ciscoOriginal assertion
Record text

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.

Inspect raw assertion
Field
container
Value
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786. Only Smart Install client switches are affected. Cisco devices that are configured as a Smart Install director are not affected by this vulnerability. Cisco Bug IDs: CSCvd40673.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

8.2% probability · 94.45th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.081950000000; percentile 0.944530000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
298Underlying assertions
149Canonical products
4Target assertions
294Constraint assertions

Grouped from 4 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

150 scope groups

cisco · source assertedn/aCisco IOS and IOS XEDirect source scope
Affected: Cisco IOS and IOS XE
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "Cisco IOS and IOS XE"}]
NVD CPE · HARDWAREciscocatalyst_2960c-12pc-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-a18b73c96ff67fdce79680cc5704f614e825b450737bcb26f0bdac7197e2d288Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960c-12pc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1db4bbd2-efbe-432c-8b4a-f58feda769aa
  2. cpe:2.3:h:cisco:catalyst_2960c-12pc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1db4bbd2-efbe-432c-8b4a-f58feda769aa
NVD CPE · HARDWAREciscocatalyst_2960c-8pc-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-d204085ca2765253dd0b7370c76ff66a6e49d8be767321260cf5284f26e9742cLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960c-8pc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e5720e0d-2b0e-4c44-ae80-9dbe88f57a93
  2. cpe:2.3:h:cisco:catalyst_2960c-8pc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e5720e0d-2b0e-4c44-ae80-9dbe88f57a93
NVD CPE · HARDWAREciscocatalyst_2960c-8tc-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-f65bf39268c36453ad1c85699f45e9d1b3fd6462c360780682fa91d1ac7946aeLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960c-8tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    948a3f12-1761-4309-bc97-41f5068aa082
  2. cpe:2.3:h:cisco:catalyst_2960c-8tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    948a3f12-1761-4309-bc97-41f5068aa082
NVD CPE · HARDWAREciscocatalyst_2960c-8tc-sEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-0ff33a365c3baf24e350d2ca6c3636f7c061788aaf56f3074111911448aea6f5Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960c-8tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6f8fb3be-77d7-44c7-b41a-4cb4a8766856
  2. cpe:2.3:h:cisco:catalyst_2960c-8tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6f8fb3be-77d7-44c7-b41a-4cb4a8766856
NVD CPE · HARDWAREciscocatalyst_2960cg-8tc-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-f6d8c0eea08f6b4162598120196676533d3d7e47bb8e9a2597809fc342898d8bLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960cg-8tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 14
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ca3f2b4a-5488-4af1-a67f-bc137312ed93
  2. cpe:2.3:h:cisco:catalyst_2960cg-8tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 14
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ca3f2b4a-5488-4af1-a67f-bc137312ed93
NVD CPE · HARDWAREciscocatalyst_2960cpd-8pt-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-e2a873e3d1da2a2024475bec736bc9ff9db84aa02a642f71c6ff4812ac9771baLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960cpd-8pt-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 15
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    57d0055e-6fc5-42c2-bd7c-c13c54060a35
  2. cpe:2.3:h:cisco:catalyst_2960cpd-8pt-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 15
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    57d0055e-6fc5-42c2-bd7c-c13c54060a35
NVD CPE · HARDWAREciscocatalyst_2960cpd-8tt-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-3dca97e4761da41b0e010d210db0c0d47446b538eedd01d702069d206bce7b95Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960cpd-8tt-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 16
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    83edaea8-7faa-4d59-a5b9-62b260e5616d
  2. cpe:2.3:h:cisco:catalyst_2960cpd-8tt-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 16
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    83edaea8-7faa-4d59-a5b9-62b260e5616d
NVD CPE · HARDWAREciscocatalyst_2960-plus_24lc-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-483e77dc1e49cb01c1ee40c814abc0f8eb678ea2866114d140f74f331e74bda7Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_24lc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ac92813c-8f6d-4d21-acc7-1c1b1ae1a8df
  2. cpe:2.3:h:cisco:catalyst_2960-plus_24lc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ac92813c-8f6d-4d21-acc7-1c1b1ae1a8df
NVD CPE · HARDWAREciscocatalyst_2960-plus_24lc-sEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-a258d386d989ec81d79560f4b1c05cb696f6153f346ffd832dd0304afb383e22Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_24lc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    11c2cdd4-f92b-4fce-bfdc-f3a2bef08ea5
  2. cpe:2.3:h:cisco:catalyst_2960-plus_24lc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    11c2cdd4-f92b-4fce-bfdc-f3a2bef08ea5
NVD CPE · HARDWAREciscocatalyst_2960-plus_24pc-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-96f5f01b7b3fcf95eb4c18f4a323fd26f7b73dc1e975ba1687a34b349d6a0b64Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_24pc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    890b8c3f-2e83-4d8c-bf9b-34b50e228822
  2. cpe:2.3:h:cisco:catalyst_2960-plus_24pc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    890b8c3f-2e83-4d8c-bf9b-34b50e228822
NVD CPE · HARDWAREciscocatalyst_2960-plus_24pc-sEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-4f339cc9d7a218c6171ce7eaadc6d4357e40cbe6d323b6c1110aa3c25faeed24Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_24pc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    de86bd73-e951-44eb-a056-6d7e015b9088
  2. cpe:2.3:h:cisco:catalyst_2960-plus_24pc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    de86bd73-e951-44eb-a056-6d7e015b9088
NVD CPE · HARDWAREciscocatalyst_2960-plus_24tc-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-00164e4dda73f245fff7e3b017b6967a1862c4a15b9d66dd58f017de5cc9c9e9Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_24tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    dbc12299-2a7b-493c-9585-560e9a110d15
  2. cpe:2.3:h:cisco:catalyst_2960-plus_24tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    dbc12299-2a7b-493c-9585-560e9a110d15
NVD CPE · HARDWAREciscocatalyst_2960-plus_24tc-sEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-1a54d8671c3819298075dc34dc4338d6bc41e237a60c62e8bd0a5541b73264afLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_24tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    13ea3f96-d65b-46b6-acdb-b4a2bdc7dafc
  2. cpe:2.3:h:cisco:catalyst_2960-plus_24tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    13ea3f96-d65b-46b6-acdb-b4a2bdc7dafc
NVD CPE · HARDWAREciscocatalyst_2960-plus_48pst-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-b21b701e25e31f6fd57b923052b564e1e586878800fa8179e8ee0f1f24d377c6Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_48pst-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    190d6dc2-d8c6-4183-b95d-28cdec1612fc
  2. cpe:2.3:h:cisco:catalyst_2960-plus_48pst-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    190d6dc2-d8c6-4183-b95d-28cdec1612fc
NVD CPE · HARDWAREciscocatalyst_2960-plus_48pst-sEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-073c54847a55d53c5472d9bf3530434527349bdaeb886f5d920b954f8d73b626Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_48pst-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1421f9c5-4a7c-476f-91ff-8108718b6e66
  2. cpe:2.3:h:cisco:catalyst_2960-plus_48pst-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1421f9c5-4a7c-476f-91ff-8108718b6e66
NVD CPE · HARDWAREciscocatalyst_2960-plus_48tc-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-ca8b7e8067cd04120756a50efcab0ca0c299796184c7fc7c46b3cbfc3099c278Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_48tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e8acdc1f-60e7-4ca7-b242-25d3f975becf
  2. cpe:2.3:h:cisco:catalyst_2960-plus_48tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e8acdc1f-60e7-4ca7-b242-25d3f975becf
NVD CPE · HARDWAREciscocatalyst_2960-plus_48tc-sEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-60b78b838f46ba462ca468321b0213d5050beb72c0cf74fb5708fcf9a029f82dLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960-plus_48tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    fed6ea2f-3479-4145-82cf-b65ff24d8f36
  2. cpe:2.3:h:cisco:catalyst_2960-plus_48tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    fed6ea2f-3479-4145-82cf-b65ff24d8f36
NVD CPE · HARDWAREciscocatalyst_2960s-24pd-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-d2f1f0977ce90e1a0db9fc857fab451e6e099e872f5dedec9a63796a4aabe107Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960s-24pd-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 17
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b5d2c8c2-8d3b-46d0-a1ea-bc0c65cd93f9
  2. cpe:2.3:h:cisco:catalyst_2960s-24pd-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 17
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b5d2c8c2-8d3b-46d0-a1ea-bc0c65cd93f9
NVD CPE · HARDWAREciscocatalyst_2960s-24ps-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-6165a5616ad81f6fc458e1c4e125765a683c6f779494a37daeb58ab776573737Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960s-24ps-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 18
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1eecca51-9f60-4fac-9291-57411441b090
  2. cpe:2.3:h:cisco:catalyst_2960s-24ps-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 18
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1eecca51-9f60-4fac-9291-57411441b090
NVD CPE · HARDWAREciscocatalyst_2960s-24td-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-b3b68b061acb856837480d6f1e30855d4cb38232394d63dfac9bfd6b4dfebf4fLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960s-24td-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 19
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    261d5183-1a3c-41ed-b196-bb0992fc5bf9
  2. cpe:2.3:h:cisco:catalyst_2960s-24td-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 19
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    261d5183-1a3c-41ed-b196-bb0992fc5bf9
NVD CPE · HARDWAREciscocatalyst_2960s-24ts-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-377fcdf57c2a60673910b53e0170b9992f5722ca35e09d6a6ee71cda1f85c4d6Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960s-24ts-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 20
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9f114380-0bb6-414c-9854-77dcebb6c9bb
  2. cpe:2.3:h:cisco:catalyst_2960s-24ts-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 20
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9f114380-0bb6-414c-9854-77dcebb6c9bb
NVD CPE · HARDWAREciscocatalyst_2960s-24ts-sEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-e90649d61945a40409959079f48af276bd866c0848d9cbd261c95c9a7926d3b4Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960s-24ts-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 21
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    90c5b9d3-bf37-4146-a12e-193ea90c9be6
  2. cpe:2.3:h:cisco:catalyst_2960s-24ts-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 21
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    90c5b9d3-bf37-4146-a12e-193ea90c9be6
NVD CPE · HARDWAREciscocatalyst_2960s-48fpd-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-7be7f7edb565e6848d9d8e1f27aebbed3eec4098b60799db407669eaf57877a7Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960s-48fpd-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 22
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    49073fbc-9df8-4a5c-8bd5-fbc2b1923d35
  2. cpe:2.3:h:cisco:catalyst_2960s-48fpd-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 22
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    49073fbc-9df8-4a5c-8bd5-fbc2b1923d35
NVD CPE · HARDWAREciscocatalyst_2960s-48fps-lEnvironmental constraint · 2 assertions
Version not applicableCanonical identity product-43ad0a819ba63d956cac539b055e3f1e51e7a540edf43793cfbfdeac44049fc9Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:h:cisco:catalyst_2960s-48fps-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 23
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1d4845c2-9710-4ce8-81c3-d81037b7e66b
  2. cpe:2.3:h:cisco:catalyst_2960s-48fps-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 23
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1d4845c2-9710-4ce8-81c3-d81037b7e66b

Affected-product evidence

Accepted scope and product mapping

2 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-0774b265c0e837e737aaf99ed0f2450c048e61f34267ca59d8623878b839334e · product-5972f4392170d0d1b4e75a10eb3b383835ead601c8d9b09329525407a4e1471a

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
6f4773dc-d9ca-4bc2-8d09-cf40cc7d9e0edb9f0960-67ca-4495-b9d6-98d6514dfd8d
Mapping establishedEvidence supported

vendor-0774b265c0e837e737aaf99ed0f2450c048e61f34267ca59d8623878b839334e · product-cc06181059d0f387414dd5737700c03a38fe93d65d4a541ac9744a37c25c9f59

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
13953529-7fd8-4193-9a29-c79effe4beb517da27bf-da0b-4712-abc6-8f70c3ad044d
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
83d7384a-d497-46e9-9a3f-8bc56edba3ed

Assessments

CVSS by origin

7.5
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.8
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:L/Au:N/C:N/I:N/A:C
7.5
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Direct CVE/CNA normalized decisions

7.5Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Validation
Valid match
Recomputed
7.5
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.