How to Fix CVE-2017-6663: Security vulnerability in Cisco IOS and IOS XE

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-24. Treat it as active exploitation, not theoretical.

What is CVE-2017-6663?

CVE-2017-6663 is a denial-of-service flaw in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software. An unauthenticated attacker on an adjacent network (Layer 2 / link-local reach, not the open internet) can send crafted Autonomic Networking traffic that causes the autonomic nodes of an affected device to reload. A reload drops every interface the device was forwarding, so in practice this is a remote crash of a router or switch. Cisco tracks the internal defect as CSCvd88936.

This is purely an availability problem. The CVSS 3.1 vector. AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, confirms it: confidentiality and integrity impact are both None, only availability is High. No data is read or altered; the device simply restarts. There is no remote code execution and no privilege escalation here, despite the device being adjacent-network reachable without authentication. The "adjacent" attack vector is what keeps the base score at 6.5 (Medium) rather than higher: an attacker must already have a foothold on a connected segment, not arbitrary internet access.

Autonomic Networking is a self-management framework Cisco shipped in certain IOS/IOS XE trains. The Known Affected Releases are Denali-16.2.1 and Denali-16.3.1. If your device never had the Autonomic Networking feature configured or running, the attack surface for this specific CVE is reduced, but the only authoritative way to confirm exposure for your exact build is the Cisco advisory below, which carries the full affected-release table and the per-train fixed builds.

Identify whether your device is affected

This CVE only touches Cisco IOS and Cisco IOS XE. From the device CLI, confirm the running train and whether Autonomic Networking is in play:

# Confirm the IOS / IOS XE train and image
show version | include Version

# Check whether Autonomic Networking is configured / running
show running-config | include autonomic
show autonomic device
show autonomic interface

Compare the reported train against the affected releases (Denali-16.2.1, Denali-16.3.1) and the full table in the Cisco advisory. If show autonomic device returns state instead of an "invalid input"/"not enabled" response, the feature is active and the device is exposed until patched.

How to fix CVE-2017-6663

The fix is to upgrade to a Cisco IOS / IOS XE release that Cisco has marked as fixed for this defect. Cisco's MITRE record does not publish a single fixed version. the fixed build depends on your hardware platform and the train you run. Use the cisco-sa-20170726-anidos advisory and the Cisco Software Checker (linked from that advisory) to look up the exact First Fixed release for your image. Do not guess a version number.

Upgrade procedure (Cisco IOS / IOS XE)

# From the device, after you have downloaded the FIXED image
# named in the Cisco advisory for your platform/train:
enable
show version | include Version            ! record the current build first
copy running-config startup-config        ! save config

# Transfer the fixed image (TFTP shown; SCP/FTP/USB also valid)
copy tftp: flash:

# Point the device at the new image and reboot into it
configure terminal
 boot system flash:<fixed-image>.bin       ! exact filename from Cisco advisory
 end
write memory
reload

# After reload, confirm the device is on the fixed build
show version | include Version

Cisco-documented workaround if you cannot upgrade yet

Where an immediate upgrade is not possible, Cisco's advisory notes that disabling the Autonomic Networking feature removes the attack surface for this CVE. Do this only after confirming you do not rely on Autonomic Networking in your topology:

# Remove the Autonomic Networking configuration
configure terminal
 no autonomic
end
write memory

# Verify the feature is no longer active
show autonomic device

Because the attack vector is adjacent, you should also limit which Layer 2 segments can reach the device's autonomic/control plane, apply Control Plane Policing (CoPP) and tight interface ACLs on links facing untrusted hosts. These are mitigations, not a substitute for the upgrade.

Frequently asked questions

Can CVE-2017-6663 be exploited from the internet?

No. The CVSS attack vector is Adjacent (AV:A), meaning the attacker must be on a network segment directly connected to the device: the same Layer 2 / link-local scope the Autonomic Networking feature operates in. It is not remotely exploitable across routed boundaries. That is also why it scores 6.5 rather than higher. It is still on the CISA KEV list, so adjacent exploitation is being observed in the wild; do not treat the adjacent constraint as safety.

Does this CVE let an attacker steal data or run code?

No. Confidentiality and integrity impact are both rated None; only availability is High. The sole effect is that affected autonomic nodes reload, the device crashes and restarts, dropping traffic. There is no RCE and no privilege escalation in CVE-2017-6663.

What is the fixed version?

Cisco's CVE record does not list a single fixed version because it varies by platform and train. The Known Affected Releases are Denali-16.2.1 and Denali-16.3.1. Use the Cisco Software Checker linked from advisory cisco-sa-20170726-anidos to find the exact First Fixed release for your image. The CVSS base score is 6.5 (Medium), vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

I can't reload the router right now. what reduces risk?

Disable the Autonomic Networking feature with no autonomic if you don't use it; Cisco documents this as the workaround. Additionally restrict which adjacent segments can reach the control plane using interface ACLs and Control Plane Policing. These reduce exposure but do not replace the upgrade.

References

• Official vendor advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170726-anidos
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-6663
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• http://www.securitytracker.com/id/1038999
• http://www.securityfocus.com/bid/99973
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6663

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Operational notes for this CVE

A reload-style denial of service like CVE-2017-6663 is easy to underestimate because nothing is stolen or altered. The operational risk is availability: a single crafted Autonomic Networking packet from an adjacent host can bounce a router that may be carrying production traffic, and an attacker can repeat it. On the CISA KEV list since 2022-03-03, this is treated as a real, exploited issue rather than a theoretical one.

Two practical points when planning the change. First, confirm whether Autonomic Networking is actually enabled before you schedule a maintenance window, many deployments on the Denali 16.2 / 16.3 trains never configured the feature, and show autonomic device tells you quickly. If it is not in use, no autonomic closes this attack surface immediately and buys time for the upgrade. Second, because the vector is adjacent rather than internet-facing, the exposed hosts are the ones sharing a Layer 2 segment or autonomic domain with the device; lock down those links with interface ACLs and Control Plane Policing as a stopgap.

The authoritative source for the per-platform First Fixed release is the Cisco advisory and its Software Checker, not third-party aggregators, which historically lag and sometimes record only partial fix data. Always re-run show version after the reload to confirm the device booted into the fixed image rather than falling back to a cached one.

Related fixes

Related weaknesses in the same component worth addressing at the same time:

• How to Fix CVE-2017-6743: Buffer overflow in IOS
• How to Fix CVE-2017-6737: Buffer overflow in IOS
• How to Fix CVE-2017-12234: Improper input validation in Cisco IOS
• How to Fix CVE-2017-12240: Improper input validation in Cisco IOS and IOS XE
• How to Fix CVE-2017-12235: Improper input validation in Cisco IOS