Denial of service in Cisco IOS XR - CVE-2017-3876
Published: May 3, 2017 / Updated: May 4, 2017
Vulnerability identifier: #VU6400
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3876
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability alows a remote attacker to cause DoS condition on the target device.
The weakness exists due to improper handling of gRPC requests in the Event Management Service daemon (emsd) of Cisco IOS XR routers. A remote attacker can send unauthenticated gRPC requests to the affected device and crash the device in such a manner that manual intervention is required to recover.
Successful exploitation of the vulnerability may result in denial of service.
The weakness exists due to improper handling of gRPC requests in the Event Management Service daemon (emsd) of Cisco IOS XR routers. A remote attacker can send unauthenticated gRPC requests to the affected device and crash the device in such a manner that manual intervention is required to recover.
Successful exploitation of the vulnerability may result in denial of service.
Affected software
Cisco IOS XR
How to mitigate CVE-2017-3876
Update to version 6.1.2 or later.