CVE-2017-6739: Cisco IOS and IOS XE SNMP buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a remotely reachable pre-auth-adjacent buffer overflow leading to code execution or DoS, and it is confirmed in CISA KEV, though exploitation requires valid SNMP credentials.

What it is

Cisco IOS and IOS XE contain a buffer overflow in the SNMP implementation that affects SNMP versions 1, 2c, and 3. A remote attacker who knows the SNMP read-only community string or SNMPv3 user credentials can send a crafted SNMP packet to crash the device or execute arbitrary code. Because SNMP is widely enabled on network gear, this is a serious edge-device risk.

Impact

Successful exploitation gives the attacker arbitrary code execution and full control of the affected device, or alternatively causes a reload and denial of service.

Attack surface

Reachable remotely over the network by sending a crafted SNMP packet directly to the affected system; the attacker must first possess the SNMP read-only community string (v1/v2c) or valid SNMPv3 user credentials, and no user interaction is required.

Exploitation

CVE-2017-6739 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating real-world exploitation; EPSS shows a 30-day probability of roughly 10.7 percent (95.6th percentile). No ransomware campaign use is documented.

What to do

• Apply the Cisco IOS/IOS XE updates referenced in Cisco advisory cisco-sa-20170629-snmp.
• If SNMP is not required, disable it entirely on affected devices.
• Where SNMP must run, restrict access with ACLs to trusted management hosts and avoid using default or guessable community strings.
• Rotate SNMP community strings and SNMPv3 credentials that may have been exposed.
• Monitor for unexpected device reloads and review SNMP access logs for anomalous sources.

Detection

• Alert on unexpected reloads or crash/restart events on Cisco IOS and IOS XE devices.
• Monitor SNMP traffic for malformed or oversized packets and for SNMP requests from untrusted source addresses.
• Audit SNMP configuration to confirm community strings are non-default and ACLs limit management access.
• Correlate device syslog and SNMP access logs for repeated failed or unusual SNMP requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.