CVE-2017-3881

Cisco IOS and IOS XE suffered a remote code execution vulnerability in the Cluster Management Protocol allowing unauthenticated attackers to execute elevated code or reload devices.

This unpatched RCE flaw in Cisco's foundational networking software allowed remote attackers to gain elevated privileges without authentication, directly impacting DIB organizations relying on Cisco infrastructure for network security and operations. The vulnerability was actively exploited in the wild, demonstrating the severe risk of relying on vendors with a history of high-severity, unpatched RCE flaws across multiple subsystems. DIB orgs must enforce strict patching cycles, limit network access to critical infrastructure, and consider diversifying vendors to mitigate systemic supply-chain risks.

Shame score — A foundational networking product suffered a high-severity RCE flaw that was actively exploited in the wild, reflecting a pattern of systemic, unpatched vulnerabilities in Cisco's software stack.