CVE-2017-6737

CVE-2017-6737 is a memory-corruption flaw (CWE-119) in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE that allows an authenticated, remote attacker to execute arbitrary code on an affected device. It is triggered by sending crafted SNMP packets to a device where SNMP is enabled; the attacker must already hold valid SNMP credentials, such as a community string or an SNMPv3 user. Successful exploitation yields remote code execution on the router or switch itself, potentially giving the attacker control of a core network device. Any organization running affected Cisco IOS or IOS XE software with SNMP enabled is exposed, with the exact vulnerable release ranges defined in Cisco's advisory. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03 (ransomware use unknown), and EPSS estimates a 44.3% probability of exploitation in the next 30 days (99th percentile); no public proof-of-concept is known.

What to do: Upgrade all Cisco IOS and IOS XE devices to a fixed release per Cisco's advisory, as CISA's KEV required action mandates, prioritizing internet-facing and management-plane devices. Until patched, restrict SNMP access to trusted management hosts with ACLs and harden or rotate SNMP community strings and SNMPv3 credentials, since valid credentials are required for exploitation. Inventory which devices have SNMP enabled and review logs for unexpected SNMP traffic from unknown sources.