CVE-2017-6742
Cisco IOS and IOS XE Software — Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Description
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device. The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system. Only traffic directed to the affected system can be used to exploit this vulnerability.
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2017-6742 carries a CVSS v3 score of 8.8 (High) with a network attack vector, low complexity, and no user interaction required — the attacker needs only valid SNMP credentials, which in many organisations have not been rotated in years. The EPSS score of 21.4 % at the 97.5th percentile places this vulnerability among the most likely to be actively exploited across the entire CVE population. Cisco IOS and IOS XE underpin core routers, WAN edge devices, and carrier infrastructure, meaning successful exploitation yields full device control or a denial-of-service reload — both critical outcomes for NIS2-scoped operators. The fact that CISA added this CVE to KEV in April 2023 — six years after the original disclosure — confirms that unpatched legacy devices remain reachable in production networks and are being actively targeted; organisations should treat any device running an unfixed IOS release with SNMP exposed beyond the management plane as critically at risk.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the vendor patch: Cisco has released fixed IOS and IOS XE releases for CVE-2017-6742. Consult Cisco Security Advisory cisco-sa-20170629-snmp to identify the correct fixed release for your train (e.g. 15.2(6)E1, 15.6(3)M1, or the corresponding IOS XE release — confirm exact version in the advisory before deploying).
- Restrict SNMP access immediately: Apply ACLs on all affected devices to limit SNMP traffic (UDP/161, UDP/162) to explicitly authorised management hosts only; deny all other sources at the device level and at the perimeter firewall.
- Disable SNMP where not operationally required: Issue
no snmp-serveron any device that does not actively use SNMP for monitoring. This is the strongest immediate compensating control if monitoring alternatives exist. - Rotate all SNMP credentials: Treat existing community strings (read-only and read-write) as compromised; replace them with strong, unique values. Renew SNMPv3 authentication passwords and privacy keys across the estate.
- Inventory affected devices: Identify all Cisco IOS and IOS XE devices with an active SNMP server (
show snmp), prioritised by network criticality — core routers, firewall clusters, and OT/SCADA-adjacent infrastructure first. - Increase logging verbosity: Forward SNMP authentication failure events and reload traps to your central SIEM (
snmp-server enable traps snmp authentication).
Runbook · Step 2
Mitigation layers
- Network segmentation: Route SNMP traffic exclusively through a dedicated out-of-band management VLAN; ensure SNMP is unreachable from production user segments and DMZs. Interface ACL example:
permit udp <mgmt-host>/32 any eq 161. - IPS/firewall rule: Enable Snort or Suricata rules targeting anomalously large SNMP PDUs or unusual OID traversal patterns. Cisco's own advisory recommends blocking SNMP packets with abnormally large varbind lists as a workaround:
alert udp any any -> $ROUTER_NET 161 (msg:"CVE-2017-6742 oversized SNMP PDU"; dsize:>1400; sid:2017674201;). - Disable SNMPv1/v2c, enforce SNMPv3 AuthPriv: All SNMP versions are vulnerable, but requiring valid credentials (SHA authentication, AES-128 or higher privacy) significantly raises the bar for unauthenticated attackers and limits lateral exploitation.
- Remove read-write community strings: If only monitoring is needed, configure read-only access exclusively and remove all RW community strings (
no snmp-server community <string> RW). - Restrict SNMP views: Limit SNMP views to the minimum required OID subtrees; exclude MIB branches not needed for monitoring to reduce the exploitable attack surface.
Runbook · Step 3
Detection rules
- Syslog / IOS logging: Alert on
%SNMP-3-AUTHFAILfollowed closely by%SYS-5-RELOADfrom the same device — this sequence is a strong exploitation indicator. SPL:index=network sourcetype=cisco:ios "SNMP-3-AUTHFAIL" OR "SYS-5-RELOAD" | transaction host maxspan=5m. - Network telemetry (Zeek/Suricata): Flag oversized SNMP PDUs (UDP/161, payload > 1400 bytes) originating from hosts outside the authorised management network. Use the Suricata rule shape above as a starting point.
- NetFlow/IPFIX: Detect SNMP connection attempts from unknown source IPs to network device addresses; baseline authorised management hosts and alert on deviations.
- SNMP trap monitoring: A cluster of
coldStartorwarmStarttraps from a single device within a short window indicates unexpected reloads — correlate in the SIEM against concurrent SNMP authentication failures. - SNMP audit logs (Cisco DNA Center or equivalent): If available, review SNMP request logs for OID write operations or queries outside the normal monitoring profile, which may indicate credential-based reconnaissance prior to exploitation.
Metrics
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp
- http://www.securityfocus.com/bid/99345vdb-entryx_refsource_BIDx_transferred
- http://www.securitytracker.com/id/1038808vdb-entryx_refsource_SECTRACKx_transferred
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmpx_refsource_CONFIRMx_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6742government-resource