CVE-2017-3881
Cisco IOS and IOS XE Remote Code Execution
- Published17 Mar 2017
- Added to CISA KEV25 Mar 2022
- Remediation due15 Apr 2022
Description
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
Remediation
No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3881
- https://www.exploit-db.com/exploits/41872/
- https://www.exploit-db.com/exploits/41874/
- http://www.securityfocus.com/bid/96960
- http://www.securityfocus.com/bid/97391
- http://www.securitytracker.com/id/1038059
Related CVEs
Recent high-severity vulnerabilities sharing a weakness type.
Frequently asked
Is CVE-2017-3881 being actively exploited?
Yes. CVE-2017-3881 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Mar 2022.
How severe is CVE-2017-3881?
CVE-2017-3881 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 99.0% probability of exploitation.
Which products are affected by CVE-2017-3881?
Affected products include Cisco iOS, Cisco iOS XE.
How do I fix CVE-2017-3881?
Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2017-3881 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.