Buffer overflow in Cisco iOS Xe Software
CVE-2017-6741
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device. The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system. Only traffic directed to the affected system can be used to exploit this vulnerability.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.066 (93.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 93.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.063 · newest: 0.066 · change: +0.003
Affected products
- Cisco iOS Xe Software — versions 16.4.1, 3.13.0aS, 3.15.1cS
- Cisco iOS Xe — versions 2.2.0, 2.2.1, 2.2.2
- Intellishield Universal Product
Weakness classification (CWE)
References
- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-…
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory, VDB Entry)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory, VDB Entry)
- af854a3a-2127-422b-91ae-364da2661108 (Vendor Advisory)
Frequently asked questions
- What is CVE-2017-6741?
- CVE-2017-6741 is a high-severity vulnerability in Cisco iOS Xe Software, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2017-07-17.
- How severe is CVE-2017-6741?
- High severity. CVSS v3 base score is 8.8 out of 10.