Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

8.8 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

6.78 %

Predictive Probability

Percentile Rank

91.3 th

Documented as more likely to be exploited than 91.3% of known CVEs.

Detection Date

Apr 19, 2023

Remediation Due

May 10, 2023

CISA Catalog Active

Threat Analysis

The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.

Remediation Directive

Apply updates per vendor instructions.

External Intelligence

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2017-6742