CVE-2017-6744: Cisco IOS vulnerability
Cisco · IOS
Affected: Cisco IOS · Exploitation: in CISA KEV since 3 Mar 2022
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue3 Mar 2022
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not established: not seen
Higher than 94% of scored CVEs
DescriptionCVE.org
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload. Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. There are workarounds that address these vulnerabilities.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Cisco · IOS12.1(3)XI; 12.2(1b)DA; 12.2(5)DA; 12.2(7)DA; 12.2(12)DA; 12.2(10)DA5 and 816 more
- IntelliShield · Universal ProductVersions not stated
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
- CISA KEV
- Listed since 3 Mar 2022 · catalogue entry
- Public check
- No public nuclei template
- Vendor
- Cisco
- Published
- July 2017
What changed
- CISA added it to the KEV catalogue CISA
CoverageNo articles yet
No CyberSIXT article names CVE-2017-6744 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.