CVE-2017-6742
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run IOS and IOS XE Software, fix it now.
CISA required action: Apply updates per vendor instructions.
US federal civilian agencies must remediate by May 10, 2023.
Patch status
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.
Description
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device. The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system. Only traffic directed to the affected system can be used to exploit this vulnerability.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Affected products
| Product | Vendor | Affected versions | Source |
|---|---|---|---|
| Cisco networking & security | Cisco | >= 2.2.0, <= 3.17 | NVD |
| IOS | Cisco | >= 12.0, <= 12.4; >= 15.0, <= 15.6 | NVD |
| IOS and IOS XE Software | Cisco | — | KEV |
Sources: NVD = NIST National Vulnerability Database; KEV = CISA Known Exploited Vulnerabilities catalog.
Intelligence timeline
Developments from the last 30 days, newest first.
- CVSS scoredUpdateKEV
CVE-2017-6742 scored CVSS 8.8: Cisco IOS and IOS XE Software, Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
CISA lists this as exploited in the wild. Unpatched IOS and IOS XE Software systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
1 earlier event is available with a subscription. See plans.
Coverage
We have not published a story about this vulnerability yet.