CVE-2017-6736

CVE-2017-6736 is one of nine buffer overflow vulnerabilities in the SNMP subsystem of Cisco IOS and IOS XE that affect all versions of SNMP (v1, 2c, and 3). An authenticated remote attacker triggers it by sending a crafted SNMP packet via IPv4 or IPv6 directly to an affected device, needing only the read-only community string for SNMPv2c or earlier, or valid SNMPv3 user credentials. A successful exploit yields arbitrary code execution with full control of the device, or forces the system to reload. Any IOS or IOS XE device with SNMP enabled that has not explicitly excluded the affected MIBs/OIDs should be considered vulnerable, including Cisco IOS-based networking gear and, per vendor notices, Rockwell industrial switches built on Cisco IOS. Exploitation is confirmed in the wild: the flaw is on CISA's KEV catalog (added 2022-03-03, with applying vendor updates as the required action), EPSS assigns a ~70.6% probability of exploitation within 30 days (99th percentile), and public proof-of-concept code is available.

What to do: Upgrade IOS/IOS XE to a fixed release identified via Cisco's IOS Software Checker, which is the required action under CISA KEV. As interim mitigation, restrict SNMP to trusted management hosts with ACLs, prefer SNMPv3 with strong credentials, and disable SNMP or exclude the affected MIBs/OIDs, since any device with SNMP enabled and the affected MIBs/OIDs not excluded is vulnerable. Also audit the network for configured SNMP community strings and internet-reachable devices accepting SNMP on IPv4 or IPv6.