CVE-2017-6736
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Description
CVE-2017-6736 is a remote code execution vulnerability in Cisco IOS and IOS XE Software. The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. Successful exploitation could allow an attacker to execute arbitrary code or cause a denial-of-service condition on affected devices. CISA has added CVE-2017-6736 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 89.13% (99.5th percentile) indicates a high likelihood of exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios | >= 12.0, <= 12.4; >= 15.0, <= 15.6 |
| cisco | ios xe | >= 2.2.0, <= 3.17 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp(Vendor Advisory)
- http://www.securityfocus.com/bid/99345(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038808(Broken Link, Third Party Advisory, VDB Entry)
- https://github.com/artkond/cisco-snmp-rce(Exploit)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp(Vendor Advisory)
- https://www.exploit-db.com/exploits/43450/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6736(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer occurs when software performs operations on a memory buffer but can read from or write to a memory location that is outside the intended boundary of the buffer. This is the parent category for many specific buffer error types including buffer overflows (CWE-120), buffer underflows, out-of-bounds reads (CWE-125), and out-of-bounds writes (CWE-787).
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2017-6736 poses a severe threat to organizations running Cisco IOS and IOS XE Software, as it enables authenticated attackers to execute arbitrary code on affected devices. With a CVSS score of 8.8 (HIGH), the vulnerability allows attackers operating from the network to compromise the affected device. A successful attack could lead to full device takeover, allowing adversaries to intercept network traffic, modify device configurations via SNMP, and use compromised devices as pivot points for lateral movement within the network. Given the critical role of network infrastructure devices in enterprise environments, compromise could disrupt business operations, enable data exfiltration, and undermine the security posture of the entire network.
Exploit Maturity
CVE-2017-6736 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming that this vulnerability has been exploited in real-world attacks. The EPSS score of 89.13% (99.5th percentile) places it among the most likely vulnerabilities to be exploited. Public exploit code is available, which significantly lowers the barrier for potential attackers. Organizations should treat this vulnerability as an active and ongoing threat requiring immediate remediation.
Remediation
- Apply vendor updates immediately as required by CISA KEV: Apply updates per vendor instructions.
- If immediate patching is not possible, implement interim mitigations such as restricting access to the affected SNMP service to trusted networks only using access control lists.
- Monitor affected devices for signs of exploitation, including unexpected reloads, unusual SNMP traffic, and anomalous process behavior.
- Audit compromised devices for unauthorized configuration changes, unexpected user accounts, and persistent backdoors.
- Consider implementing network segmentation to limit the blast radius of a compromised network device.
Technical Details
CVE-2017-6736 is a remote code execution vulnerability in the Simple Network Management Protocol (SNMP) of Cisco IOS and IOS XE Software. The vulnerability allows an authenticated remote attacker to send specially crafted packets over the network to trigger a buffer overflow condition, potentially leading to arbitrary code execution with elevated privileges. The CVSS v3.1 score of 8.8 reflects low attack complexity with no user interaction needed, and high impact across confidentiality, integrity, and availability. The attack is conducted via network.
Frequently Asked Questions
Is CVE-2017-6736 being actively exploited?
Yes. CVE-2017-6736 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 89.13% (99.5th percentile) further indicates a high likelihood of ongoing exploitation.
What products are affected by CVE-2017-6736?
CVE-2017-6736 affects Cisco IOS and IOS XE Software. Specifically, affected products include Cisco Ios, Cisco Ios Xe.
How do I fix CVE-2017-6736?
Apply updates per vendor instructions. As this vulnerability allows remote code execution, prioritize patching immediately. If patching is delayed, restrict access to the vulnerable SNMP service and monitor for exploitation attempts.
How severe is CVE-2017-6736?
CVE-2017-6736 has a CVSS score of 8.8 (HIGH). This is a high-severity vulnerability that enables remote code execution, which could lead to complete compromise of network infrastructure devices. The combination of low privilege requirement and low attack complexity makes this a significant threat.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.