CVE-2017-6742

CVE-2017-6742 is a memory-corruption flaw (CWE-119) in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE. It is triggered when an affected device processes crafted SNMP packets sent by an authenticated, remote attacker, meaning the device must have SNMP enabled and the attacker must hold valid SNMP credentials or community strings. Successful exploitation lets the attacker execute code on the router or switch, or force the device to reload, yielding either full control of the device or a denial of service on critical network infrastructure. Any organization running vulnerable Cisco IOS or IOS XE releases with SNMP enabled on routers, switches, or other network devices is affected. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2023-04-19), confirming in-the-wild exploitation; EPSS estimates a 21.4% probability of exploitation within 30 days (97th percentile), and no public proof-of-concept code is known.

What to do: Upgrade affected Cisco IOS and IOS XE devices to fixed releases per Cisco's advisory, prioritizing internet-facing routers and switches as the KEV listing makes patching mandatory for federal agencies and urgent for others. As interim mitigation, restrict SNMP access to trusted management hosts with ACLs, disable SNMP entirely where it is not required, and rotate SNMP community strings/credentials that could be used for authentication. Inventory devices for enabled SNMP services and vulnerable releases, focusing first on edge and internet-exposed infrastructure.