CVE-2017-6627

CVE-2017-6627 is a denial-of-service flaw in the UDP packet processing code of Cisco IOS and IOS XE, caused by application changes that create UDP sockets and leave them idle without closing them. An unauthenticated, remote attacker can trigger it by sending UDP packets with a destination port of 0 to an affected device, causing packets to be held in the interface input queue; once roughly 250 packets accumulate, the queue wedges and the device stops forwarding traffic on that interface until it is cleared or reloaded. A successful attack affects availability only, with no confidentiality or integrity impact (CVSS 3.1: 7.5 High, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Any organization running the affected IOS 15.1, 15.2, or 15.4 trains or IOS XE 3.14 through 3.18 is exposed, particularly where the device accepts UDP traffic from untrusted networks or the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, indicating known exploitation in the wild (ransomware use unknown); no public proof-of-concept is known, and EPSS estimates a 6.0% chance of exploitation in the next 30 days (93rd percentile).

What to do: Inventory routers and switches running IOS 15.1, 15.2, or 15.4 and IOS XE 3.14–3.18, and upgrade to fixed releases per Cisco's advisory (bug IDs CSCup10024, CSCva55744, CSCva95506), as required by the CISA KEV catalog. As an interim mitigation, restrict or filter unsolicited UDP traffic destined to the device itself (for example via infrastructure ACLs) and monitor interface input queues for wedges; a wedged queue may require clearing the interface or reloading the device to restore service.