CVE-2017-6742
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Description
CVE-2017-6742 is a high-severity buffer overflow vulnerability in the SNMP implementation of Cisco IOS and IOS XE software. The flaw allows an authenticated remote attacker to send specially crafted SNMP packets that trigger a buffer overflow, potentially enabling remote code execution or causing a device reload. Affecting all SNMP versions (v1, v2c, and v3), the vulnerability requires the attacker to know the SNMP community string or user credentials. With a CVSS score of 8.8 and an EPSS score of 5.7% (90th percentile), CVE-2017-6742 has been added to CISA's Known Exploited Vulnerabilities catalog, highlighting confirmed in-the-wild exploitation against Cisco network infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios | >= 12.0, <= 12.4; >= 15.0, <= 15.6 |
| cisco | ios xe | >= 2.2.0, <= 3.17 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp(Vendor Advisory)
- http://www.securityfocus.com/bid/99345(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038808(Broken Link, Third Party Advisory, VDB Entry)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6742(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
In CVE-2017-6742, the buffer overflow weakness manifests in Cisco IOS and IOS XE's SNMP processing code, where input from crafted SNMP packets is written beyond the boundaries of allocated memory buffers. This improper restriction of memory operations allows an attacker with valid SNMP credentials to overwrite adjacent memory, leading to arbitrary code execution with full system privileges or a denial-of-service condition through device reload.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2017-6742 carries a CVSS 3.1 score of 8.8 (High), reflecting significant risk to network infrastructure. The vulnerability is remotely exploitable over the network without requiring physical access to the device, and the attack complexity is low, meaning the exploit can be executed reliably once credentials are obtained. Low-level privileges are required — the attacker must possess valid SNMP community strings (for SNMPv1/v2c) or user credentials (for SNMPv3) — but no user interaction is necessary, enabling automated attacks. Confidentiality, integrity, and availability impacts are all rated high, meaning a successful exploit can grant the attacker full control of the Cisco device, allow modification of routing configurations, and cause complete service disruption through device reloads. The EPSS score of 5.7% (90th percentile) indicates elevated exploitation probability, and CISA has confirmed active exploitation in the wild, making this a critical priority for organizations running Cisco IOS or IOS XE infrastructure.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2017-6742 in the wild and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 10, 2023. While dedicated public exploit code on major exploit databases is limited, the vulnerability has been targeted by advanced persistent threat actors against Cisco network infrastructure, as documented in the Cisco security advisory. The EPSS score of 5.7% (90th percentile) places this vulnerability in the upper tier of exploitation likelihood. Ransomware association is currently unknown, but the ability to achieve full device control makes it a high-value target for state-sponsored and sophisticated threat actors targeting critical network infrastructure.
Remediation
- Apply Cisco security patches as directed by CISA: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Consult the Cisco Security Advisory cisco-sa-20170629-snmp for specific patched IOS and IOS XE versions applicable to your hardware platform.
- Upgrade Cisco IOS and IOS XE to patched software versions. Since all SNMP versions (v1, v2c, and v3) are affected, ensure the updated firmware addresses the buffer overflow regardless of the SNMP version in use on your devices.
- Restrict SNMP access by implementing access control lists (ACLs) on Cisco devices to limit SNMP traffic to trusted management stations only. Disable SNMP if it is not required, or migrate from SNMPv1/v2c to SNMPv3 with strong authentication and encryption credentials. Change all default or well-known community strings immediately.
- Monitor network devices for indicators of compromise, including unexpected device reloads, unauthorized configuration changes, and anomalous SNMP traffic patterns. Review device logs for crash reports that may indicate exploitation attempts and check for unauthorized SNMP access in the device's SNMP logging.
- Implement network segmentation to isolate management plane traffic from data plane traffic. Place all network device management interfaces on dedicated out-of-band management networks, preventing direct SNMP access from user-facing or internet-exposed network segments.
Technical Details
CVE-2017-6742 is a buffer overflow vulnerability (CWE-119) in the SNMP subsystem of Cisco IOS and IOS XE software. The flaw occurs when the SNMP processing code fails to properly validate the length of data within crafted SNMP packets, allowing an attacker to write beyond the allocated buffer boundaries and corrupt adjacent memory. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring low-level privileges (PR:L) in the form of a valid SNMP community string or SNMPv3 credentials, and no user interaction (UI:N). The vulnerability affects all three SNMP protocol versions — SNMPv1, SNMPv2c, and SNMPv3 — meaning any device with SNMP enabled is potentially at risk regardless of the version configured. An attacker who successfully triggers the buffer overflow can either achieve arbitrary code execution with full system privileges, gaining complete control over the network device, or cause a denial of service by forcing the device to reload. Only traffic directed specifically at the affected device can trigger the vulnerability, limiting the attack surface to directly reachable SNMP-enabled interfaces.
Frequently Asked Questions
Is CVE-2017-6742 being actively exploited?
Yes, CVE-2017-6742 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 10, 2023. The vulnerability has been targeted by advanced threat actors against Cisco network infrastructure. While ransomware association is currently unknown, the EPSS score of 5.7% indicates elevated exploitation probability.
What products are affected by CVE-2017-6742?
CVE-2017-6742 affects Cisco IOS and Cisco IOS XE software across multiple hardware platforms. All versions of SNMP (v1, v2c, and v3) are vulnerable. Organizations should consult the Cisco Security Advisory for specific affected IOS and IOS XE version numbers applicable to their deployed hardware.
How do I fix CVE-2017-6742?
Apply the patched Cisco IOS and IOS XE software versions as documented in the Cisco Security Advisory cisco-sa-20170629-snmp. As interim mitigations, restrict SNMP access using ACLs to allow only trusted management stations, disable SNMP if not required, and change all default community strings.
How severe is CVE-2017-6742?
CVE-2017-6742 is rated High with a CVSS 3.1 score of 8.8 out of 10. While SNMP credentials are required for exploitation, the attack complexity is low and no user interaction is needed. The vulnerability can lead to full device compromise including remote code execution or denial of service through device reload.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.