Vulnerability record · CVE-2017-6738 · published 17 July 2017
CVE-2017-6738: Cisco IOS and IOS XE SNMP buffer overflow allows remote code execution
Cisco · Ios
The SNMP subsystem in Cisco IOS and IOS XE Software contains a buffer overflow that affects SNMP versions 1, 2c, and 3. An authenticated remote attacker can send a crafted SNMP packet over IPv4 or IPv6 to execute arbitrary code or reload the device, making this a serious risk for any reachable device with SNMP enabled.
Description
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload. Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. There are workarounds that address these vulnerabilities.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution with full device control on widely deployed network gear, confirmed in CISA KEV, though exploitation requires valid SNMP credentials.
What it is
The SNMP subsystem in Cisco IOS and IOS XE Software contains a buffer overflow that affects SNMP versions 1, 2c, and 3. An authenticated remote attacker can send a crafted SNMP packet over IPv4 or IPv6 to execute arbitrary code or reload the device, making this a serious risk for any reachable device with SNMP enabled.
Impact
Successful exploitation gives the attacker arbitrary code execution and full control of the affected device, or alternatively causes a reload (denial of service).
Attack surface
Reached remotely over the network via crafted SNMP packets sent to the device on IPv4 or IPv6; only traffic directed to the affected system works. Authentication is required: SNMPv2c or earlier needs the read-only community string, and SNMPv3 needs valid user credentials, with no user interaction.
Exploitation
CVE-2017-6738 is listed in CISA KEV (added 2022-03-03), indicating known exploitation in the wild, and EPSS shows a 30-day probability of about 10.7 percent (95.6th percentile). References are vendor advisories and government catalog entries; no public exploit code is cited in the record.
What to do
- Apply the fixed Cisco IOS/IOS XE software identified via the Cisco IOS Software Checker, or apply the vendor workaround if patching cannot be done immediately.
- Disable SNMP where it is not required, and explicitly exclude the affected MIBs/OIDs where SNMP must remain enabled.
- Restrict SNMP access with ACLs so only trusted management hosts can reach UDP 161/162, and avoid using SNMPv1/v2c community strings.
- Rotate SNMP community strings and SNMPv3 credentials, since exploitation requires knowledge of these secrets.
- Monitor Cisco advisories for updated fixed-software guidance and re-verify exposure after changes.
Detection
- Alert on SNMP traffic to managed devices from hosts outside the approved management subnet or from unexpected source IPs.
- Inspect SNMP packet captures for malformed or oversized PDUs targeting the affected MIBs/OIDs.
- Monitor device logs and syslog for unexpected reloads, crashes, or SNMP subsystem faults on Cisco IOS/IOS XE devices.
- Track configuration changes that enable SNMP or add community strings on network devices.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-6738 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 24 March 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp | Vendor Advisory |
| http://www.securityfocus.com/bid/99345 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038808 | Broken LinkThird Party AdvisoryVDB Entry |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6738 | US Government Resource |
Track CVE-2017-6738 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-6738), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
