Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

8.8 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

21.42 %

Predictive Probability

Percentile Rank

97.3 th

Documented as more likely to be exploited than 97.3% of known CVEs.

Detection Date

Apr 19, 2023

Remediation Due

May 10, 2023

CISA Catalog Active

Threat Analysis

The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.

Remediation Directive

Apply updates per vendor instructions.

External Intelligence

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2017-6742