CVE-2017-6736
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
YesDecision
Descriptions
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve57697.
El subsistema Simple Network Management Protocol (SNMP) de Cisco IOS versión 12.0 hasta 12.4 y versión 15.0 hasta 15.6 e IOS XE versión 2.2 hasta 3.17 de Cisco, contiene múltiples vulnerabilidades que podrían permitir a un atacante remoto autenticado ejecutar el código remotamente en un sistema afectado o causar que un sistema afectado se recargué. Un atacante podría explotar estas vulnerabilidades enviando un paquete SNMP creado a un sistema afectado por medio de IPv4 o IPv6. Solo el tráfico dirigido a un sistema afectado puede ser usado para explotar estas vulnerabilidades. Las vulnerabilidades son debido a una condición de desbordamiento del búfer en el subsistema SNMP del software afectado. Las vulnerabilidades afectan a todas las versiones de SNMP: Versiones 1, 2c y 3. Para explotar estas vulnerabilidades por medio de SNMP Versión 2c o anterior, el atacante necesita conocer la cadena community de solo lectura de SNMP para el sistema afectado. Para explotar estas vulnerabilidades por medio de la versión 3 de SNMP, el atacante necesita tener credenciales de usuario para el sistema afectado. Todos los dispositivos que hayan habilitado SNMP y no hayan excluido explícitamente las MIB u OID afectadas deben considerarse vulnerables. Identificación de errores de Cisco: CSCve57697.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
CVSS Scores
SSVC
- Decision:Act
Timeline
- 2017-03-09 CVE Reserved
- 2017-07-17 CVE Published
- 2022-03-03 Exploited in Wild
- 2022-03-24 KEV Due Date
- 2024-09-08 EPSS Updated
- 2024-11-15 CVE Updated
- 2024-11-15 First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/99345 | Broken Link | |
| http://www.securitytracker.com/id/1038808 | Broken Link |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/43450 | 2024-11-15 | |
| https://github.com/artkond/cisco-snmp-rce | 2024-11-15 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp | 2024-07-24 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | >= 12.0 <= 12.4 Search vendor "Cisco" for product "Ios" and version " >= 12.0 <= 12.4" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | >= 15.0 <= 15.6 Search vendor "Cisco" for product "Ios" and version " >= 15.0 <= 15.6" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Ios Xe Search vendor "Cisco" for product "Ios Xe" | >= 2.2.0 <= 3.17 Search vendor "Cisco" for product "Ios Xe" and version " >= 2.2.0 <= 3.17" | - |
Affected
| ||||||