⚠ Actively exploited
Added to CISA KEV on 2022-03-25. Federal agencies required to patch by 2022-04-15. Required action: Apply updates per vendor instructions..

CVE-2017-3881 — Improper Input Validation in Cisco IOS

CWE-20 — Improper Input Validation10 documents9 sources
Severity
9.8CRITICALNVD
EPSS
94.3%
top 0.06%
CISA KEV
KEV
Added 2022-03-25
Due 2022-04-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
3
Cisco IOSCisco IOS XECisco IOS AND IOS XE Software
Timeline
PublishedMar 17
KEV addedMar 25
KEV dueApr 15
Latest updateMay 13
CISA Required Action: Apply updates per vendor instructions.

Description

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet opti…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5cisco/cisco_ios_and_ios_xe_softwareCisco IOS and IOS XE Software
▶NVDcisco/ios12.2s — 15.1\(3\)svs
▶NVDcisco/ios_xe3.2sg — 3.9e

🔴Vulnerability Details

3
GHSA
GHSA-g37w-qg7v-7fjq: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated,↗2022-05-13
▶
CVEList
CVE-2017-3881: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated,↗2017-03-17
▶
VulnCheck
Cisco IOS and IOS XE Remote Code Execution Vulnerability↗2017
▶

💥Exploits & PoCs

3
Exploit-DB
Cisco Catalyst 2960 IOS 12.2(55)SE11 - 'ROCEM' Remote Code Execution↗2017-04-12
▶
Exploit-DB
Cisco Catalyst 2960 IOS 12.2(55)SE1 - 'ROCEM' Remote Code Execution↗2017-04-12
▶
Nuclei
Cisco IOS 12.2(55)SE11 - Remote Code Execution
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT Cisco Catalyst Remote Code Execution (CVE-2017-3881)↗2017-04-10
▶

📋Vendor Advisories

2
CISA
Cisco IOS and IOS XE Remote Code Execution Vulnerability↗2022-03-25
▶
Cisco
Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability↗2017-03-17
▶
CVE-2017-3881 — Improper Input Validation in Cisco IOS | cvebase