CVE-2017-6627: Cisco IOS and IOS XE UDP port 0 packet queue wedge denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, causes denial of service, and is listed in CISA KEV as known exploited, though impact is limited to availability.

What it is

Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 leave UDP sockets idle without closing them, so UDP packets sent to destination port 0 accumulate in the input interface queue. Once the queue wedges, the device stops processing traffic on that interface, producing a denial-of-service condition. The flaw is remotely reachable without authentication and requires no user interaction.

Impact

An unauthenticated remote attacker can wedge the input queue of an affected interface, causing a denial of service that disrupts traffic handling on the device. The queue only stops holding packets after 250 are received, so the effect is bounded but still service-affecting.

Attack surface

Reached over the network by sending UDP packets with destination port 0 to an affected device, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

CVE-2017-6627 is listed in CISA KEV with a due date of 2022-03-24, indicating known exploitation, and EPSS shows a 30-day probability of about 6.0 percent (92.99th percentile). No ransomware campaign use is documented.

What to do

• Apply the Cisco IOS and IOS XE updates referenced in the vendor advisory cisco-sa-20170906-ios-udp, prioritizing internet-facing and edge devices.
• If immediate patching is not possible, follow the vendor advisory's mitigation guidance for affected releases.
• Restrict or filter UDP traffic destined to port 0 at network boundaries where operationally feasible.
• Track affected devices against the Cisco bug IDs CSCup10024, CSCva55744, and CSCva95506 to confirm exposure.
• Monitor interface input queues for wedging behavior and plan for device reload or interface reset as a recovery step.

Detection

• Monitor interface input queue depth and drops on Cisco IOS and IOS XE devices for sustained growth or wedge conditions.
• Alert on UDP traffic with destination port 0 reaching managed network devices.
• Correlate interface queue stalls with a sudden absence of expected traffic on the affected interface.
• Review device logs and interface counters for queue-full or input-hold events following suspicious UDP bursts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.