EXPOSURES › CVE-2017-6738
CVE-2017-6738
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco IOS and IOS XE SNMP subsystems allowed authenticated remote attackers to execute arbitrary code via CVE-2017-6738.
The SNMP subsystem in Cisco IOS and IOS XE software contained a vulnerability enabling authenticated remote attackers to execute arbitrary code. This is a critical failure for DIB organizations relying on Cisco network infrastructure, as it represents a known, unpatched vulnerability that was actively exploited in the wild (KEV). Organizations must ensure all Cisco IOS and IOS XE devices are patched to prevent potential compromise of network management systems.
Shame score — A known, unpatched vulnerability in a widely deployed network operating system that was actively exploited in the wild, representing a severe negligence in patch management and supply chain security.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |