CVE-2017-6739

CVE-2017-6739 is a buffer overflow (CWE-119) in the SNMP implementation of Cisco IOS and IOS XE that allows an authenticated, remote attacker to execute arbitrary code or cause a device reload. It is triggered by sending a crafted SNMP packet directed at the affected device, and the attacker must already know the SNMP read-only community string (v1/v2c) or valid SNMPv3 user credentials; the flaw affects all SNMP versions (1, 2c, and 3). Successful code execution gives the attacker full control of the router or switch, while a simpler exploit path causes a denial-of-service reload. Any organization running Cisco IOS or IOS XE with SNMP enabled is potentially affected, which given Cisco's dominance in enterprise networking represents a very large installed base. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), confirming in-the-wild exploitation, and EPSS assigns a 10.7% probability of exploitation in the next 30 days (96th percentile).

What to do: Apply Cisco's fixed IOS/IOS XE software releases per the vendor advisory, consistent with the CISA KEV required action; if patching must be deferred, restrict SNMP access to trusted management hosts with access control lists, disable SNMP where it is unused, and prefer SNMPv3 with strong, unique credentials. Audit whether SNMP is enabled and reachable from untrusted networks, and rotate default or widely shared community strings (e.g., 'public'), since only traffic directed to the device can trigger the flaw.