How to Fix CVE-2017-6738: SNMP buffer overflow in Cisco IOS and IOS XE

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-24. Treat it as active exploitation, not theoretical.

What is CVE-2017-6738?

CVE-2017-6738 is one of nine buffer overflow flaws in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and Cisco IOS XE Software, all disclosed together in Cisco advisory cisco-sa-20170629-snmp. The defect lets an authenticated remote attacker either run arbitrary code on the device and take full control of it, or force the device to reload, so this is a remote code execution flaw with a denial-of-service fallback, not a simple memory crash.

The technical root cause is a buffer overflow in how the SNMP subsystem parses incoming packets, which is why MITRE classifies it as CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. An attacker triggers it by sending a crafted SNMP packet to the device over IPv4 or IPv6. Only traffic directed at the device itself can be used; SNMP traffic merely transiting the device cannot.

The authentication requirement is the practical gate. To reach the vulnerable code over SNMP v1 or v2c, the attacker must already know the device's read-only community string. Over SNMP v3, the attacker needs valid user credentials. That is why the CVSS 3.0 vector records PR:L (low privileges required) rather than none, scoring it 8.8 High. The flaw affects all three SNMP versions, and Cisco considers any device that has SNMP enabled and has not explicitly excluded the affected MIBs or OIDs to be vulnerable.

CVE-2017-6738 sits on the CISA Known Exploited Vulnerabilities catalog, and Cisco PSIRT confirmed it among the advisory CVEs for which it observed exploitation, so the threat is real-world rather than theoretical.

Identify whether your device is affected

This is purely a Cisco IOS / IOS XE issue, so work from the device CLI: there is nothing to check on a server, FortiGate, or PAN-OS box. First confirm your software train, then confirm SNMP is actually enabled (a device with SNMP disabled is not exposed):

# On the Cisco IOS / IOS XE device
show version | include (Version|IOS)
show snmp
show running-config | include snmp-server

If show snmp returns SNMP statistics and show running-config | include snmp-server shows configured communities or v3 users or hosts, SNMP is active. Take the exact version string from show version and run it through the Cisco IOS Software Checker linked in advisory cisco-sa-20170629-snmp; because the affected and fixed builds differ by train (12.2 SE/EX/EY/SG/SQ, 15.x M/T/SY, IOS XE 3.x and 16.x), only the checker will tell you authoritatively whether your specific image is exposed and what the first fixed release is.

How to fix CVE-2017-6738

The fix is to upgrade Cisco IOS or IOS XE to a release in which this defect is resolved. Cisco did not publish a single global fixed version for this advisory: the first fixed release is specific to each software train. Do not guess a version, feed your running build into the Cisco IOS Software Checker and let it return the first fixed release for your platform.

Upgrade procedure (run on the device)

# Vendor advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp
! 1. Record the current build so you can confirm the change later
show version | include Version

! 2. Save the running config before touching anything
copy running-config startup-config

! 3. Copy the fixed image (from the Software Checker) onto the device
copy tftp: flash:

! 4. Point the device at the new image and reload during a change window
configure terminal
 boot system flash:.bin
end
write memory
reload

! 5. After reboot, confirm the new build is running
show version | include Version

On IOS XE platforms that use the install model, the equivalent is install add file ... activate commit rather than the legacy boot system command. match the procedure to your platform's mode. After the upgrade, verify the running version equals the first fixed release the Software Checker reported for your train.

If you can't upgrade immediately

The advisory documents a real workaround for this CVE: disable the specific SNMP MIBs that contain the affected object identifiers. You build an SNMP view that excludes those MIBs and bind it to every community string and v3 group. Cisco lists the affected MIBs in the advisory; exclude each one in your view. None of this replaces the upgrade.

# Cisco IOS / IOS XE: exclude the affected MIBs via an SNMP view, then apply it
! See cisco-sa-20170629-snmp for the full MIB list to exclude
configure terminal
 snmp-server view NO_VULN_MIBS iso included
 snmp-server view NO_VULN_MIBS ciscoFlashMIB excluded
 snmp-server view NO_VULN_MIBS ciscoIpTapMIB excluded
 snmp-server view NO_VULN_MIBS ciscoSyslogMIB excluded
 ! ...repeat 'excluded' for every MIB named in the advisory...
 ! Bind the view to each community
 snmp-server community  view NO_VULN_MIBS RO
 ! And to each v3 group
 snmp-server group  v3 priv read NO_VULN_MIBS
end
write memory

As a second layer, restrict which hosts may reach SNMP at all so that only your trusted management stations can send SNMP to the device:

# Limit SNMP to a trusted management subnet
configure terminal
 access-list 90 permit 10.0.0.0 0.255.255.255
 snmp-server community  RO 90
end
write memory

Verify the device is no longer exposed

After upgrading, confirm the running image matches the fixed release for your train, and confirm the workaround view (if you applied one) is in place:

# Confirm the running build is the fixed release from the Software Checker
show version | include Version

# Confirm the SNMP view excludes the affected MIBs and is bound
show snmp view
show running-config | include snmp-server (community|group)

Because this defect lives in the SNMP subsystem, the device must reload for an image upgrade to take effect, there is no service to restart in isolation. A simple reachability test from an authorized host (snmpwalk against a non-excluded OID) confirms SNMP still functions for legitimate monitoring after the change.

Does an attacker need credentials to exploit CVE-2017-6738?

Yes. The attacker must be authenticated to SNMP. For SNMP v1 or v2c they need the read-only community string of the target device; for SNMP v3 they need valid user credentials. With that, a single crafted SNMP packet over IPv4 or IPv6 can trigger the buffer overflow and lead to remote code execution or a device reload. That authentication gate is why the CVSS vector records PR:L rather than no privileges.

What is the fixed version of Cisco IOS or IOS XE for CVE-2017-6738?

There is no single fixed version. Cisco resolved the flaw on a per-train basis, so the first fixed release depends on whether you run a 12.2 SE/EX/SG/SQ train, a 15.x M/T/SY train, or an IOS XE 3.x or 16.x train. Enter your exact running build into the Cisco IOS Software Checker in advisory cisco-sa-20170629-snmp to get the correct target release for your image.

Can I mitigate CVE-2017-6738 without upgrading right away?

Yes. The Cisco advisory documents a workaround: create an SNMP view that excludes the specific MIBs containing the affected OIDs, then bind that view to every community string and v3 group. Restricting SNMP to trusted management hosts reduces exposure further. Neither step replaces the upgrade, but together they materially shrink the attack surface until you can reload onto a fixed image.

How do I know if my device is exposed to CVE-2017-6738?

Any Cisco IOS or IOS XE device with SNMP enabled that has not excluded the affected MIBs or OIDs should be treated as vulnerable, across SNMP v1, v2c, and v3. Run show snmp and show running-config | include snmp-server to confirm SNMP is configured, then check your exact version against the Cisco IOS Software Checker.

References

• Official vendor advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-6738
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• http://www.securityfocus.com/bid/99345
• http://www.securitytracker.com/id/1038808
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6738

Written by Sai Kiran Pandrala on 2026-05-25, last reviewed 2026-06-12 by Sai Kiran Pandrala. Always confirm against the vendor's advisory and the Cisco IOS Software Checker before applying changes in production.

Related fixes

Related weaknesses in the same component worth addressing at the same time:

• How to Fix CVE-2017-12319: Improper input validation in Cisco IOS XE
• How to Fix CVE-2017-12237: Cwe-399 in Cisco IOS and IOS XE
• How to Fix CVE-2017-12235: Improper input validation in Cisco IOS
• How to Fix CVE-2017-12233: Improper input validation in Cisco IOS
• How to Fix CVE-2017-6740: Buffer overflow in IOS