How to Fix CVE-2017-6627: Cisco IOS / IOS XE UDP Packet DoS

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-24. Treat it as active exploitation, not theoretical.

What is CVE-2017-6627?

CVE-2017-6627 is a denial-of-service flaw in the UDP packet-processing code of Cisco IOS and Cisco IOS XE Software. Certain software features open UDP sockets and then leave those sockets idle without ever closing them. That leak is the root cause, and it is why the record carries CWE-399 (Resource Management Errors) rather than a memory-corruption or injection class. There is no code execution here and no data disclosure. The single consequence is that an affected interface stops forwarding traffic.

An unauthenticated, remote attacker triggers the bug by sending UDP packets with a destination port of 0 to the device. Those packets land in the input interface queue and are held there instead of being processed and freed. The queue wedges. Once it is wedged it keeps buffering UDP and dropping legitimate packets, so the interface effectively goes dark for everything riding behind it. Cisco notes one quirk worth understanding: the input interface queue stops holding the UDP packets once it has received 250 of them. In practice that means a single burst can wedge an interface, and a sustained low-rate stream keeps re-wedging it, which is exactly the pattern that makes this attractive to attackers and easy to automate.

The official base score is CVSS 3.1 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Note the impact profile: confidentiality and integrity are NONE, availability is HIGH. That is the signature of a pure availability bug. The flaw matters because it sits on the data and control path of routers and switches that often carry an entire site or branch, so a single wedged uplink can read like a full network outage to everyone downstream.

This is not a theoretical risk. CISA placed CVE-2017-6627 on the Known Exploited Vulnerabilities catalog on 2022-03-03, and the CISA SSVC assessment marks exploitation as active and automatable. See the Exploitation status block above for the full timeline and remediation deadline.

Am I affected?

The advisory scopes this to Cisco IOS 15.1, 15.2, and 15.4 and Cisco IOS XE 3.14 through 3.18. The vulnerability only exists where a feature has created an idle, unclosed UDP socket, so exposure also depends on which software features you have enabled. From the device CLI, check your running release:

! On the Cisco IOS / IOS XE device itself
enable
show version | include (Version|IOS|RELEASE)

! List the UDP sockets the device currently has open
! (idle, unclosed UDP sockets are the precondition for this bug)
show udp
show ip sockets

Take the release string from show version (for example 15.2(4)M7 or 03.16.05.S) and run it through the Cisco Software Checker on the advisory. The checker is the authoritative source: it tells you whether your exact train and platform are affected and, if so, the first fixed release. Do not rely on the major version alone, because the fix landed at different maintenance builds across different trains.

How to fix CVE-2017-6627

There is no configuration toggle that removes this vulnerability. The fix is to upgrade Cisco IOS or IOS XE to a fixed release. Cisco did not publish a single global fixed version for this advisory; the first fixed build differs per train and platform. So the first step is always to look up your fixed target, not to guess it.

Step 1: find your fixed release

1. Open the advisory: cisco-sa-20170906-ios-udp.
2. Use the Cisco Software Checker on that page. Enter your platform and your current release (the exact string from show version).
3. The checker returns the first fixed release for your device. That is your upgrade target. If your device has a current support contract, download the fixed image from Cisco; if it does not, contact the Cisco TAC or your reseller, because you cannot pull fixed images without entitlement.

Step 2: upgrade the device

Once you have the fixed image, the upgrade follows the standard IOS / IOS XE procedure. Back up first, stage the image, set it as the boot image, and reload during a maintenance window. Reloading a router or switch is disruptive by design, so schedule it.

! Run on the device console / SSH session
enable

! 1. Record the current state and back up the config off-box
show version | include (Version|RELEASE)
copy running-config startup-config
copy running-config tftp://10.0.0.5/cve-2017-6627-pre.cfg

! 2. Confirm there is room, then copy the FIXED image to flash
dir flash:
copy tftp://10.0.0.5/<fixed-image>.bin flash:

! 3. (IOS XE bundle mode) verify the image before booting it
verify flash:<fixed-image>.bin

! 4. Point the boot system at the fixed image
configure terminal
 no boot system
 boot system flash:<fixed-image>.bin
end
write memory

! 5. Reload in your maintenance window
reload

On platforms that run IOS XE in install mode, use the package workflow instead of boot system:

! IOS XE install mode (Catalyst 9000, ASR 1000, etc.)
install add file flash:<fixed-image>.bin activate commit
! the device reloads as part of activation; confirm afterward with:
show version
show install summary

If you can't upgrade immediately

Cisco states there is no workaround that addresses the vulnerability itself. The controls below only reduce who can reach the device with the malicious UDP traffic; they do not stop the queue wedge if an attacker is inside the permitted path. Treat them as a bridge to the upgrade, not a substitute.

Block untrusted UDP to the device with an infrastructure ACL

An infrastructure ACL (iACL) applied at your network edge keeps untrusted sources from sending UDP directly to your router and switch management/loopback addresses. Permit only the protocols and peers you actually need to reach the control plane, and deny the rest.

! Infrastructure ACL: filter UDP destined to device infrastructure space.
! Adjust 192.0.2.0/24 to your real infrastructure (loopbacks, mgmt) block.
ip access-list extended INFRA-IACL
 ! permit the control-plane protocols you genuinely run to the infra block
 permit udp host 10.0.0.5 192.0.2.0 0.0.0.255 eq snmp
 permit udp 10.0.0.0 0.0.0.255 192.0.2.0 0.0.0.255 eq ntp
 ! deny everything else UDP aimed at the infrastructure block, log it
 deny   udp any 192.0.2.0 0.0.0.255 log
 ! normal transit traffic continues
 permit ip any any
!
interface GigabitEthernet0/0
 ip access-group INFRA-IACL in
end
write memory

Rate-limit UDP to the control plane with CoPP

Control-plane policing (CoPP) caps how much UDP can reach the route processor, so a flood cannot saturate the input path even if some packets are permitted. This is the closest thing to a mitigation for a resource-exhaustion DoS.

! Police UDP punted to the control plane
ip access-list extended COPP-UDP
 permit udp any any
!
class-map match-all CM-UDP
 match access-group name COPP-UDP
!
policy-map CONTROL-PLANE-POLICY
 class CM-UDP
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input CONTROL-PLANE-POLICY
end
write memory

Restrict the management plane

! Limit who can even reach VTY / management to a trusted subnet
ip access-list standard MGMT-ONLY
 permit 10.0.0.0 0.255.255.255
 deny   any log
!
line vty 0 15
 access-class MGMT-ONLY in
 transport input ssh
end
write memory

How to verify the fix worked

After the reload, confirm two things: the device booted the fixed image, and the interface queues are healthy.

! 1. Confirm the running release matches the fixed build from the Software Checker
show version | include (Version|RELEASE)

! 2. Confirm no interface input queue is wedged (look for input-queue drops/flushes)
show interfaces | include (line protocol|Input queue|total output drops)

! 3. Confirm boot variable points at the fixed image (survives next reload)
show bootvar
show boot

The release reported by show version must be at or above the first fixed build the Cisco Software Checker returned for your platform. On show interfaces, the input queue should drain normally rather than sitting pinned at its maximum. If you had deployed the iACL or CoPP mitigation while waiting to upgrade, you can leave both in place afterward as defense in depth; neither conflicts with the fixed image, and both are good hygiene for any internet-facing router.

How does CVE-2017-6627 actually cause an outage?

Affected Cisco IOS and IOS XE builds open UDP sockets and leave them idle without closing them. An unauthenticated remote attacker sends UDP packets with destination port 0 to the device, and those packets get held in the input interface queue and wedge it, dropping legitimate traffic. The queue stops holding packets only after it receives 250 of them, so a sustained stream keeps the interface in a denial-of-service state.

Which Cisco IOS and IOS XE versions are affected by CVE-2017-6627?

Cisco IOS 15.1, 15.2, and 15.4, and Cisco IOS XE 3.14 through 3.18 are called out in the advisory. The fixed release depends on your specific train and platform, so check your exact build against the Cisco Software Checker linked in the advisory rather than assuming a single global fixed number.

What is the fixed version for CVE-2017-6627?

Cisco did not publish one global fixed number; the first fixed release differs per IOS/IOS XE train. Use the Cisco Software Checker on the cisco-sa-20170906-ios-udp advisory, enter your platform and current release, and it returns the first fixed build for your device.

Can I mitigate CVE-2017-6627 without upgrading?

There is no command-line workaround that fully removes the vulnerability, per Cisco. You can reduce exposure with infrastructure ACLs (iACLs) and control-plane policing (CoPP) that block or rate-limit UDP destined to the device, especially UDP destination port 0, from untrusted sources. These are interim controls only; the queue wedge is fixed solely by upgrading to a patched IOS or IOS XE release.

References

• Official vendor advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-ios-udp
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-6627
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• http://www.securityfocus.com/bid/100644
• http://www.securitytracker.com/id/1039289
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6627

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2017-3881: Improper Input Validation in Cisco IOS and IOS XE
• How to Fix CVE-2017-6663: Security vulnerability in Cisco IOS and IOS XE
• How to Fix CVE-2017-6737: Buffer overflow in IOS
• How to Fix CVE-2017-12237: Cwe-399 in Cisco IOS and IOS XE
• How to Fix CVE-2017-12319: Improper input validation in Cisco IOS XE