CVE-2017-6740: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve66601.
Other sources
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
— CISA
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload. Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. There are workarounds that address these vulnerabilities.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable SNMP on Cisco IOS devices where SNMP is not required (turn off the SNMP service).
Cisco IOS SNMP SNMP enabled = false - Configuration
Configure SNMP to explicitly exclude the affected MIBs or OIDs so those MIBs/OIDs are not accessible via SNMP.
Cisco IOS SNMP excluded MIBs/OIDs = exclude affected MIBs/OIDs - Compensating control
Restrict SNMP access to trusted management hosts only — apply ACLs or firewall rules to permit SNMP (UDP 161/162) only from trusted IP addresses and block SNMP from untrusted networks.
- Operational
Change SNMP read-only community strings (and other community strings as appropriate) to new, strong values and rotate SNMPv3 user credentials and keys to reduce the risk from credential knowledge.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6740?
CVE-2017-6740 is rated as critical due to the potential for remote code execution.
How do I fix CVE-2017-6740?
To fix CVE-2017-6740, upgrade to a Cisco IOS version that is not affected, as specified in the security advisory.
Are all Cisco IOS versions vulnerable to CVE-2017-6740?
No, only certain versions of Cisco IOS and IOS XE from 12.0 to 15.6 are affected by CVE-2017-6740.
Can an unauthenticated attacker exploit CVE-2017-6740?
No, an attacker must be authenticated to exploit CVE-2017-6740.
What type of vulnerability is CVE-2017-6740?
CVE-2017-6740 is classified as a remote code execution vulnerability in the SNMP subsystem.