Buffer overflow in Cisco IOS XE and Cisco IOS - CVE-2017-6736
Published: July 3, 2017 / Updated: June 17, 2021
Vulnerability identifier: #VU7290
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6736
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.
The weakness exists in the Simple Network Management Protocol (SNMP) subsystem due to buffer overflow when handling malicious input. A remote attacker can send specially crafted SNMP packet via IPv4 or IPv6, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability results in system compromise.
The weakness exists in the Simple Network Management Protocol (SNMP) subsystem due to buffer overflow when handling malicious input. A remote attacker can send specially crafted SNMP packet via IPv4 or IPv6, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability results in system compromise.
Affected software
Cisco IOS XE
Cisco IOS
Allen-Bradley Stratix 8300 Modular Managed Ethernet Switches
Allen-Bradley Stratix 5400 Industrial Ethernet Switches
Allen-Bradley Stratix 5410 Industrial Distribution Switches
Allen-Bradley Stratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley ArmorStratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley Stratix 8000 Modular Managed Ethernet Switches
Allen-Bradley Stratix 5900 Services Router
Cisco IOS
Allen-Bradley Stratix 8300 Modular Managed Ethernet Switches
Allen-Bradley Stratix 5400 Industrial Ethernet Switches
Allen-Bradley Stratix 5410 Industrial Distribution Switches
Allen-Bradley Stratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley ArmorStratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley Stratix 8000 Modular Managed Ethernet Switches
Allen-Bradley Stratix 5900 Services Router
How to mitigate CVE-2017-6736
The vulnerability is addressed in the following versions:
16.7(0.63), 16.6(0.229), 15.7(3.1.4A)OT, 15.7(2.0m)M, 15.5(3)S5.22, 15.2(1.2.82)SY2, 15.1(2)SY10.99.
16.7(0.63), 16.6(0.229), 15.7(3.1.4A)OT, 15.7(2.0m)M, 15.5(3)S5.22, 15.2(1.2.82)SY2, 15.1(2)SY10.99.
Links to Public Exploits and PoC-codes
- Exploit #6325 - Cisco IOS - Remote Code Execution (June 17, 2021)
- Exploit #1961 - CiscoIOSSNMPToolkit (Cisco iOS SNMP Overflow Exploit Toolkit (CVE-2017-6736)) (March 18, 2020)
- Exploit #2093 - CiscoSpectreTakeover (A POC chain exploit using the recent Cisco SMP exploit (CVE-2017-6736) to chain into Spectre (CVE-2017-5753 and CVE-2017-5715)) (March 18, 2020)