New Rootkit Campaign Exploits Cisco SNMP Flaw to Gain Persistence

CVE-2017-3881 is a critical (CVSS 9.8) unauthenticated remote code execution flaw, classified CWE-20, in the Cluster Management Protocol (CMP) processing code of Cisco IOS and IOS XE, which uses Telnet internally for signaling between switch cluster members. Because affected devices accept CMP-specific Telnet options on any inbound Telnet connection and mishandle malformed ones, an unauthenticated attacker who opens a Telnet session to a Telnet-enabled device and sends malformed CMP options can trigger the flaw. Successful exploitation lets the attacker execute arbitrary code with elevated privileges, gaining full control of the device, or force a reload of the switch. Affected hardware spans over 300 switching models per related coverage — Catalyst switches, Embedded Service 2020 and IE Industrial Ethernet switches, several EtherSwitch service modules, the ME 4924-10GE, RF Gateway 10, and the CGESM module for HP — running IOS or IOS XE with Telnet enabled; devices that accept only SSH are not remotely exploitable. The bug was disclosed via the March 2017 WikiLeaks Vault 7 CIA leak (tied to the 'Zero Disco' toolkit in related coverage), patched by Cisco that month, has a public PoC (Exploit-DB 41872), was added to CISA's KEV on 2022-03-25 (ransomware use unknown), and EPSS rates a 99% probability of exploitation in 30 days (100th percentile), so in-the-wild exploitation should be assumed.

Do: Upgrade affected switches to the fixed IOS/IOS XE releases listed in Cisco's advisory for bug CSCvd48893 (the CISA KEV required action is to apply the vendor updates). Until patched, disable Telnet on vty lines and use SSH, or restrict inbound TCP/23 to trusted management hosts, since the bug is only reachable via inbound Telnet sessions. Audit configurations for 'transport input telnet' and prioritize internet-facing or widely reachable Catalyst, IE industrial, and EtherSwitch-service-module devices.

Cisco IOS and IOS XE contain a stack-based buffer overflow (CWE-121) in the Simple Network Management Protocol (SNMP) subsystem. An attacker who can reach the device's SNMP service can send crafted SNMP requests: with a low-privileged SNMP account the attacker can crash the device and force a reload (denial of service), while with a high-privileged SNMP account the attacker can execute arbitrary code as root and take full control of the device. Any organization running Cisco IOS or IOS XE on routers, switches, or controllers is potentially affected, especially where SNMP is enabled or reachable from untrusted networks. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-29, confirming exploitation in the wild, and EPSS assigns it a 39.4% probability of exploitation within 30 days (99th percentile). CVSS scoring is not yet available and no public proof-of-concept is known, but defenders should treat the flaw as actively exploited.

Do: Upgrade IOS and IOS XE devices to fixed software releases as specified in Cisco's security advisory; given the KEV listing, federal agencies should follow BOD 22-01 timelines or apply vendor-directed mitigations. As interim mitigation, restrict SNMP access to trusted management hosts using ACLs (and management VRFs where supported), disable SNMP on devices that do not need it, and audit existing SNMP community strings and SNMPv3 users to identify accounts with high privilege levels, which expose the root code-execution path.