EXPOSURES › CVE-2017-6737
CVE-2017-6737
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco IOS and IOS XE software suffered a remote code execution vulnerability in its SNMP subsystem that allowed authenticated attackers to execute arbitrary code remotely.
The SNMP subsystem in Cisco IOS and IOS XE software contained a vulnerability enabling authenticated remote attackers to execute code, which was actively exploited in the wild. DIB organizations must ensure continuous patching and strict access controls for network infrastructure to prevent similar exposures. This failure highlights the risk of relying on foundational network software with persistent high-severity vulnerabilities.
Shame score — The vulnerability was actively exploited in the wild and required continuous patching, indicating systemic issues in input validation and a failure to maintain a secure posture over time.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |