CVE-2017-6736 Explained : Impact and Mitigation

Cisco SNMP Subsystem Vulnerabilities

Understanding CVE-2017-6736

Multiple vulnerabilities in the SNMP subsystem of Cisco IOS and IOS XE versions could allow remote code execution or system reload.

What is CVE-2017-6736?

The SNMP subsystem of Cisco IOS and IOS XE versions 12.0 through 12.4 and 15.0 through 15.6, as well as IOS XE versions 2.2 through 3.17, contains vulnerabilities that could be exploited by a remote attacker to execute code or cause system reload.

The Impact of CVE-2017-6736

Authorized remote attackers could execute code or reload the system
Requires sending a crafted SNMP packet to the affected system
Vulnerabilities exist due to an overflow condition in the SNMP subsystem
All SNMP versions (1, 2c, and 3) are affected
Attackers need SNMP community string or user credentials for exploitation
Devices with SNMP enabled and not excluding affected MIBs or OIDs are vulnerable

Technical Details of CVE-2017-6736

Vulnerability Description

Buffer overflow in SNMP subsystem Affected Systems and Versions
Cisco IOS versions 12.0-12.4, 15.0-15.6, and IOS XE versions 2.2-3.17 Exploitation Mechanism
Crafted SNMP packet via IPv4 or IPv6

Mitigation and Prevention

Immediate Steps to Take

Disable SNMP if not required
Apply vendor patches and updates Long-Term Security Practices
Regularly update and patch systems
Implement network segmentation and access controls Patching and Updates
Apply patches provided by Cisco