EXPOSURES › CVE-2017-6736
CVE-2017-6736
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco IOS and IOS XE software contained an SNMP remote code execution vulnerability allowing authenticated attackers to execute arbitrary code remotely.
The SNMP subsystem in Cisco IOS and IOS XE software had a vulnerability enabling authenticated remote attackers to execute code, which was actively exploited in the wild. Defense-industrial-base organizations must ensure continuous patching of network infrastructure and strict access controls to mitigate such systemic RCE risks. This failure highlights the need for rigorous supply-chain security and prompt vulnerability management to prevent exploitation of foundational networking software.
Shame score — A high-severity RCE in foundational networking software was actively exploited in the wild, indicating systemic issues in input validation and delayed patching that could compromise entire network infrastructures.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |