Buffer overflow in Cisco IOS XE and Cisco IOS - CVE-2017-6741

Vulnerability identifier: #VU7295

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-6741

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists in the Simple Network Management Protocol (SNMP) subsystem due to buffer overflow when handling malicious input. A remote attacker can send specially crafted SNMP packet via IPv4 or IPv6, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability results in system compromise.

Cisco IOS XE
Cisco IOS
Allen-Bradley Stratix 8300 Modular Managed Ethernet Switches
Allen-Bradley Stratix 5400 Industrial Ethernet Switches
Allen-Bradley Stratix 5410 Industrial Distribution Switches
Allen-Bradley Stratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley ArmorStratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley Stratix 8000 Modular Managed Ethernet Switches
Allen-Bradley Stratix 5900 Services Router

The vulnerability is addressed in the following versions:
16.7(0.63), 16.6(0.229), 16.5(1.61), 15.7(3.1.4A)OT, 15.7(2.0o)M, 15.5(3)S5.22, 15.2(1.2.81)SY2, 15.1(2)SY10.99, 8.2(154.58).

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp

• Remote code execution in Cisco IOS and Cisco IOS XE
• Remote code execution in Rockwell Automation Stratix, ArmoStratix and Allen-Bradley Stratix