CVE-2017-6742
Published: 17 July 2017
Summary
CVE-2017-6742 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Cisco Ios. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-2 (Flaw Remediation).
Deeper analysis
A buffer overflow vulnerability exists in the SNMP implementation on affected Cisco devices, impacting all versions of the protocol including 1, 2c, and 3. The flaw allows an authenticated remote attacker to trigger a system reload or execute arbitrary code by sending a specially crafted SNMP packet directed at the device. The issue stems from improper handling of SNMP traffic and carries a CVSS score of 8.8 with the CWE-119 classification.
An attacker who knows the read-only community string for SNMPv2c or earlier, or valid user credentials for SNMPv3, can exploit the vulnerability to obtain full control of the system or cause a denial-of-service condition through a reload. Exploitation is possible over the network but requires the attacker to direct traffic specifically to the vulnerable device rather than relying on spoofed or broadcast packets.
Cisco security advisories recommend applying the available patches or mitigations referenced in cisco-sa-20170629-snmp, while the listing in the CISA Known Exploited Vulnerabilities catalog indicates confirmed real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-15796
Vulnerability details
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the…
more
affected device. The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system. Only traffic directed to the affected system can be used to exploit this vulnerability.
- CWE(s)
- KEV Date Added
- 19 April 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying patches or vendor fixes for the SNMP buffer overflow flaw before exploitation can succeed.
Enforces boundary protections such as ACLs or management-station restrictions that block crafted SNMP packets from reaching the device.
Enforces authenticated access policies for SNMP, limiting the set of principals who can send the malicious packets that trigger the overflow.