HackZoneLabs News
Newsletter

CVE-2017-6742

Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

  • High 8.8
  • Exploited: added to CISA KEV 19 Apr 2023

Description

A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device.  The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system. Only traffic directed to the affected system can be used to exploit this vulnerability.

Key facts

Published
17 Jul 2017
Last changed
12 Jan 2026
Assigned by
cisco
KEV added
19 Apr 2023
KEV fix due
10 May 2023
EPSS
21.261% likely to be exploited in the next 30 days, higher than 97.636% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: no; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 8.8CVSS 3.0, Highfrom the CNA (cisco)CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What to do

  • Apply updates per vendor instructions.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
CiscoCisco IOS XE Software
  • 3.7.0S (affected)
  • 3.7.1S (affected)
  • 3.7.2S (affected)
  • 3.7.3S (affected)
  • 3.7.4S (affected)
  • 3.7.5S (affected)
  • 3.7.6S (affected)
  • 3.7.7S (affected)
  • 3.7.4aS (affected)
  • 3.7.2tS (affected)
  • 3.7.0bS (affected)
  • 3.8.0S (affected)
  • 3.8.1S (affected)
  • 3.8.2S (affected)
  • 3.9.1S (affected)
  • 3.9.0S (affected)
  • 3.9.2S (affected)
  • 3.9.0aS (affected)
  • 3.11.1S (affected)
  • 3.11.2S (affected)
  • 3.11.0S (affected)
  • 3.11.3S (affected)
  • 3.11.4S (affected)
  • 3.12.0S (affected)
  • 3.12.1S (affected)
  • 3.12.2S (affected)
  • 3.12.3S (affected)
  • 3.12.0aS (affected)
  • 3.12.4S (affected)
  • 3.13.0S (affected)
  • 3.13.1S (affected)
  • 3.13.2S (affected)
  • 3.13.3S (affected)
  • 3.13.4S (affected)
  • 3.13.5S (affected)
  • 3.13.2aS (affected)
  • 3.13.0aS (affected)
  • 3.13.5aS (affected)
  • 3.13.6S (affected)
  • 3.13.7S (affected)
  • 3.13.6aS (affected)
  • 3.13.7aS (affected)
  • 3.6.3E (affected)
  • 3.6.6E (affected)
  • 3.6.5bE (affected)
  • 3.14.0S (affected)
  • 3.14.1S (affected)
  • 3.14.2S (affected)
  • 3.14.3S (affected)
  • 3.14.4S (affected)
  • 3.15.0S (affected)
  • 3.15.1S (affected)
  • 3.15.2S (affected)
  • 3.15.1cS (affected)
  • 3.15.3S (affected)
  • 3.15.4S (affected)
  • 3.7.4E (affected)
  • 3.7.5E (affected)
  • 3.16.0S (affected)
  • 3.16.1S (affected)
  • 3.16.1aS (affected)
  • 3.16.2S (affected)
  • 3.16.0cS (affected)
  • 3.16.3S (affected)
  • 3.16.2bS (affected)
  • 3.16.4aS (affected)
  • 3.16.4bS (affected)
  • 3.16.5S (affected)
  • 3.16.4dS (affected)
  • 3.17.0S (affected)
  • 3.17.1S (affected)
  • 3.17.2S (affected)
  • 3.17.1aS (affected)
  • 3.17.3S (affected)
  • 16.2.1 (affected)
  • 16.2.2 (affected)
  • 16.3.1 (affected)
  • 16.3.2 (affected)
  • 16.3.3 (affected)
  • 16.3.1a (affected)
  • 16.3.4 (affected)
  • 16.4.1 (affected)
  • 16.4.2 (affected)
  • 16.5.1 (affected)
  • 16.5.1b (affected)
  • 3.18.0aS (affected)
  • 3.18.0S (affected)
  • 3.18.1S (affected)
  • 3.18.0SP (affected)
  • 3.18.1SP (affected)
  • 3.18.1aSP (affected)
  • 3.18.2aSP (affected)
IntelliShieldUniversal Product
  • N/A (affected)

Timeline

  1. 17 Jul 2017 Published
  2. 19 Apr 2023 Added to the CISA KEV catalogue

Weakness

References