CVE-2017-3856: High severity Cisco IOS XE vulnerability

Published Mar 22, 2017

Updated

A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. An attacker could exploit this vulnerability by sending a high number of requests to the web user interface of the affected software. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the attacker must have access to the management interface of the affected software, which is typically connected to a restricted management network. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the web user interface of the software is enabled. By default, the web user interface is not enabled. Cisco Bug IDs: CSCup70353.

Affected Software

198 affected components

Cisco IOS XE=3.1.0s

Cisco IOS XE=3.1.0sg

Cisco IOS XE=3.1.1s

Cisco IOS XE=3.1.1sg

Cisco IOS XE=3.1.2s

Cisco IOS XE=3.1.3as

Cisco IOS XE=3.1.3s

Cisco IOS XE=3.1.4as

Cisco IOS XE=3.1.4s

Cisco IOS XE=3.1s

Cisco IOS XE=3.1sg

Cisco IOS XE=3.2.0ja

Cisco IOS XE=3.2.0se

Cisco IOS XE=3.2.0sg

Cisco IOS XE=3.2.0xo

Cisco IOS XE=3.2.1s

Cisco IOS XE=3.2.1se

Cisco IOS XE=3.2.1sg

Cisco IOS XE=3.2.1xo

Cisco IOS XE=3.2.2s

Cisco IOS XE=3.2.2se

Cisco IOS XE=3.2.2sg

Cisco IOS XE=3.2.3se

Cisco IOS XE=3.2.3sg

Cisco IOS XE=3.2.4sg

Cisco IOS XE=3.2.5sg

Cisco IOS XE=3.2.6sg

Cisco IOS XE=3.2.7sg

Cisco IOS XE=3.2.8sg

Cisco IOS XE=3.2.9sg

Cisco IOS XE=3.2.11sg

Cisco IOS XE=3.2ja

Cisco IOS XE=3.2s

Cisco IOS XE=3.2se

Cisco IOS XE=3.2sg

Cisco IOS XE=3.2xo

Cisco IOS XE=3.3.0s

Cisco IOS XE=3.3.0se

Cisco IOS XE=3.3.0sg

Cisco IOS XE=3.3.0sq

Cisco IOS XE=3.3.0xo

Cisco IOS XE=3.3.1s

Cisco IOS XE=3.3.1se

Cisco IOS XE=3.3.1sg

Cisco IOS XE=3.3.1sq

Cisco IOS XE=3.3.1xo

Cisco IOS XE=3.3.2s

Cisco IOS XE=3.3.2se

Cisco IOS XE=3.3.2sg

Cisco IOS XE=3.3.2xo

Cisco IOS XE=3.3.3se

Cisco IOS XE=3.3.4se

Cisco IOS XE=3.3.5se

Cisco IOS XE=3.3s

Cisco IOS XE=3.3se

Cisco IOS XE=3.3sg

Cisco IOS XE=3.3sq

Cisco IOS XE=3.3xo

Cisco IOS XE=3.4.0as

Cisco IOS XE=3.4.0s

Cisco IOS XE=3.4.0sg

Cisco IOS XE=3.4.0sq

Cisco IOS XE=3.4.1s

Cisco IOS XE=3.4.1sg

Cisco IOS XE=3.4.1sq

Cisco IOS XE=3.4.2s

Cisco IOS XE=3.4.2sg

Cisco IOS XE=3.4.3s

Cisco IOS XE=3.4.3sg

Cisco IOS XE=3.4.4s

Cisco IOS XE=3.4.4sg

Cisco IOS XE=3.4.5s

Cisco IOS XE=3.4.5sg

Cisco IOS XE=3.4.6s

Cisco IOS XE=3.4.6sg

Cisco IOS XE=3.4.7sg

Cisco IOS XE=3.4.8sg

Cisco IOS XE=3.4s

Cisco IOS XE=3.4sg

Cisco IOS XE=3.4sq

Cisco IOS XE=3.5.0e

Cisco IOS XE=3.5.0s

Cisco IOS XE=3.5.0sq

Cisco IOS XE=3.5.1e

Cisco IOS XE=3.5.1s

Cisco IOS XE=3.5.1sq

Cisco IOS XE=3.5.2e

Cisco IOS XE=3.5.2s

Cisco IOS XE=3.5.2sq

Cisco IOS XE=3.5.3e

Cisco IOS XE=3.5.3sq

Cisco IOS XE=3.5.4sq

Cisco IOS XE=3.5.5sq

Cisco IOS XE=3.5e

Cisco IOS XE=3.5s

Cisco IOS XE=3.5sq

Cisco IOS XE=3.6.0e

Cisco IOS XE=3.6.0s

Cisco IOS XE=3.6.1e

Cisco IOS XE=3.6.1s

Cisco IOS XE=3.6.2ae

Cisco IOS XE=3.6.2s

Cisco IOS XE=3.6.3e

Cisco IOS XE=3.6.4e

Cisco IOS XE=3.6.5ae

Cisco IOS XE=3.6.5be

Cisco IOS XE=3.6.5e

Cisco IOS XE=3.6e

Cisco IOS XE=3.6s

Cisco IOS XE=3.7.0bs

Cisco IOS XE=3.7.0e

Cisco IOS XE=3.7.0s

Cisco IOS XE=3.7.1e

Cisco IOS XE=3.7.1s

Cisco IOS XE=3.7.2e

Cisco IOS XE=3.7.2s

Cisco IOS XE=3.7.2ts

Cisco IOS XE=3.7.3e

Cisco IOS XE=3.7.3s

Cisco IOS XE=3.7.4e

Cisco IOS XE=3.7.4s

Cisco IOS XE=3.7.5s

Cisco IOS XE=3.7.6s

Cisco IOS XE=3.7.7s

Cisco IOS XE=3.7e

Cisco IOS XE=3.7s

Cisco IOS XE=3.8.0e

Cisco IOS XE=3.8.0ex

Cisco IOS XE=3.8.0s

Cisco IOS XE=3.8.1e

Cisco IOS XE=3.8.1s

Cisco IOS XE=3.8.2e

Cisco IOS XE=3.8.2s

Cisco IOS XE=3.8e

Cisco IOS XE=3.8ex

Cisco IOS XE=3.8s

Cisco IOS XE=3.9.0e

Cisco IOS XE=3.9.0s

Cisco IOS XE=3.9.1s

Cisco IOS XE=3.9.2s

Cisco IOS XE=3.9e

Cisco IOS XE=3.9s

Cisco IOS XE=3.10.0s

Cisco IOS XE=3.10.1s

Cisco IOS XE=3.10.1xbs

Cisco IOS XE=3.10.2s

Cisco IOS XE=3.10.2ts

Cisco IOS XE=3.10.3s

Cisco IOS XE=3.10.4s

Cisco IOS XE=3.10.5s

Cisco IOS XE=3.10.6s

Cisco IOS XE=3.10.7s

Cisco IOS XE=3.10.8s

Cisco IOS XE=3.10s

Cisco IOS XE=3.11.0s

Cisco IOS XE=3.11.1s

Cisco IOS XE=3.11.2s

Cisco IOS XE=3.11.3s

Cisco IOS XE=3.11.4s

Cisco IOS XE=3.11s

Cisco IOS XE=3.12.0as

Cisco IOS XE=3.12.0s

Cisco IOS XE=3.12.1s

Cisco IOS XE=3.12.2s

Cisco IOS XE=3.12.3s

Cisco IOS XE=3.12.4s

Cisco IOS XE=3.12s

Cisco IOS XE=3.13.0as

Cisco IOS XE=3.13.0s

Cisco IOS XE=3.13.1s

Cisco IOS XE=3.13.2as

Cisco IOS XE=3.13.2s

Cisco IOS XE=3.13.3s

Cisco IOS XE=3.13.4s

Cisco IOS XE=3.13s

Cisco IOS XE=3.14.0s

Cisco IOS XE=3.14.1s

Cisco IOS XE=3.14.2s

Cisco IOS XE=3.14.3s

Cisco IOS XE=3.14.4s

Cisco IOS XE=3.14s

Cisco IOS XE=3.15.0s

Cisco IOS XE=3.15.1cs

Cisco IOS XE=3.15.1s

Cisco IOS XE=3.15.2s

Cisco IOS XE=3.15.3s

Cisco IOS XE=3.15s

Cisco IOS XE=3.16.0cs

Cisco IOS XE=3.16.0s

Cisco IOS XE=3.16.1as

Cisco IOS XE=3.16.1s

Cisco IOS XE=3.16s

Cisco IOS XE=3.17.0s

Cisco IOS XE=3.17.1as

Cisco IOS XE=3.17.1s

Cisco IOS XE=3.17.2s

Cisco IOS XE=3.17.3s

Cisco IOS XE=3.17s

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cisco IOS XE Software to a version that resolves this vulnerability.
Fixed in 3.1 through 3.17Patch CSCup70353
Configuration
Ensure the web user interface is not enabled (by default it is not enabled). This vulnerability affects Cisco IOS XE releases only if the web UI is enabled.
Cisco IOS XE web user interface web user interface enabled = disabled
Compensating control
Restrict access to the management interface/web user interface to the restricted management network (limit to trusted sources) since exploitation requires access to the management interface.

Event History

Mar 22, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3856?

CVE-2017-3856 has a CVSS score of 7.5, indicating it is a high severity vulnerability.

How do I fix CVE-2017-3856?

To fix CVE-2017-3856, upgrade your Cisco IOS XE to a version that applies the necessary patches.

What can an attacker do exploiting CVE-2017-3856?

An attacker exploiting CVE-2017-3856 can cause an affected device to reload, leading to denial of service.

Which versions of Cisco IOS XE are affected by CVE-2017-3856?

CVE-2017-3856 affects Cisco IOS XE versions 3.1 through 3.17.

Is there a workaround for CVE-2017-3856?

Currently, the recommended action is to apply the software updates; no specific workaround is provided.