Vulnerability Intelligence Report

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

CVE-2017-6742

A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device.  The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system. Only traffic directed to the affected system can be used to exploit this vulnerability.

CISA KEV SSVC: Active Exploitation

CVSS Base Score

8.8

HIGH

Exploitability:2.9

Impact Score:5.9

EPSS Probability:21.42%

Executive Threat Verdict

Evaluating...

Evaluating Threat Landscape...

Assessing known weaponization, exploitation telemetry, and federal advisories.

Attack Surface

—

Authentication

—

Weaponization

—

SSVC Action

—

Weaknesses (CWE)

CWE-119 ↗CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected Products & Versions

Vendor	Product	Affected Versions
Cisco	Cisco IOS XE Software	3.7.0S (affected), 3.7.1S (affected), 3.7.2S (affected), 3.7.3S (affected), 3.7.4S (affected), 3.7.5S (affected), 3.7.6S (affected), 3.7.7S (affected), 3.7.4aS (affected), 3.7.2tS (affected), 3.7.0bS (affected), 3.8.0S (affected), 3.8.1S (affected), 3.8.2S (affected), 3.9.1S (affected), 3.9.0S (affected), 3.9.2S (affected), 3.9.0aS (affected), 3.11.1S (affected), 3.11.2S (affected), 3.11.0S (affected), 3.11.3S (affected), 3.11.4S (affected), 3.12.0S (affected), 3.12.1S (affected), 3.12.2S (affected), 3.12.3S (affected), 3.12.0aS (affected), 3.12.4S (affected), 3.13.0S (affected), 3.13.1S (affected), 3.13.2S (affected), 3.13.3S (affected), 3.13.4S (affected), 3.13.5S (affected), 3.13.2aS (affected), 3.13.0aS (affected), 3.13.5aS (affected), 3.13.6S (affected), 3.13.7S (affected), 3.13.6aS (affected), 3.13.7aS (affected), 3.6.3E (affected), 3.6.6E (affected), 3.6.5bE (affected), 3.14.0S (affected), 3.14.1S (affected), 3.14.2S (affected), 3.14.3S (affected), 3.14.4S (affected), 3.15.0S (affected), 3.15.1S (affected), 3.15.2S (affected), 3.15.1cS (affected), 3.15.3S (affected), 3.15.4S (affected), 3.7.4E (affected), 3.7.5E (affected), 3.16.0S (affected), 3.16.1S (affected), 3.16.1aS (affected), 3.16.2S (affected), 3.16.0cS (affected), 3.16.3S (affected), 3.16.2bS (affected), 3.16.4aS (affected), 3.16.4bS (affected), 3.16.5S (affected), 3.16.4dS (affected), 3.17.0S (affected), 3.17.1S (affected), 3.17.2S (affected), 3.17.1aS (affected), 3.17.3S (affected), 16.2.1 (affected), 16.2.2 (affected), 16.3.1 (affected), 16.3.2 (affected), 16.3.3 (affected), 16.3.1a (affected), 16.3.4 (affected), 16.4.1 (affected), 16.4.2 (affected), 16.5.1 (affected), 16.5.1b (affected), 3.18.0aS (affected), 3.18.0S (affected), 3.18.1S (affected), 3.18.0SP (affected), 3.18.1SP (affected), 3.18.1aSP (affected), 3.18.2aSP (affected)
IntelliShield	Universal Product	N/A (affected)

Exploitation & Remediation

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗

No reference links found.

Threat Intelligence Signals

CISA KEV

ACTIVE IN CATALOG

EPSS Score

21.424%

GitHub Advisory

GHSA-cw5p-gwrw-rv56 ↗

CVSS Vector Breakdown

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality

Integrity

Availability

Identity & Timeline

Status	PUBLISHED
Assigning Authority	Cisco Systems, Inc. · Hosted Service · USA
Reserved	2017-03-09T00:00:00
Published	2017-07-17T21:00:00
Last Updated	2026-01-12T19:25:59

MITRE ATT&CK Mapping

Tactics

Techniques

CVE-2017-6742

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

CVE-2017-6742

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

Community Chatter & Buzz

Related Intelligence

SHARE INTELLIGENCE WIRE