The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 up to and including 12.4 and 15.0 up to and including 15.6 and IOS XE 2.2 up to and including 3.17 contains multiple vulnerabilities that could allow an authenticated, remote malicious user to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve54313.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
cisco ios xe 3.3.2s |
||
cisco ios xe 3.3.0se |
||
cisco ios xe 3.7.5s |
||
cisco ios xe 3.4.4s |
||
cisco ios xe 3.8.0s |
||
cisco ios xe 3.10.1s |
||
cisco ios xe 3.3.1s |
||
cisco ios xe 2.5.1 |
||
cisco ios xe 3.10.8as |
||
cisco ios xe 3.5.0s |
||
cisco ios xe 3.1.4s |
||
cisco ios xe 2.2.3 |
||
cisco ios xe 3.7.3s |
||
cisco ios xe 3.17.1s |
||
cisco ios xe 3.13.5s |
||
cisco ios xe 3.8.0ex |
||
cisco ios xe 2.3.0 |
||
cisco ios xe 2.4.1 |
||
cisco ios xe 3.3.0s |
||
cisco ios xe 3.13.2s |
||
cisco ios xe 3.16.0s |
||
cisco ios xe 3.12.4s |
||
cisco ios xe 3.10.0s |
||
cisco ios xe 2.3.1 |
||
cisco ios xe 3.7.0s |
||
cisco ios xe 3.2.1s |
||
cisco ios xe 3.11.0s |
||
cisco ios xe 3.16.4s |
||
cisco ios xe 3.4.0s |
||
cisco ios xe 3.6.0s |
||
cisco ios xe 2.4.2 |
||
cisco ios xe 3.4.1s |
||
cisco ios xe 3.4.6s |
||
cisco ios xe 3.8.2s |
||
cisco ios xe 3.14.4s |
||
cisco ios xe 3.10.8s |
||
cisco ios xe 3.7.1s |
||
cisco ios xe 2.2.2 |
||
cisco ios xe 3.4.2s |
||
cisco ios xe 3.12.0s |
||
cisco ios xe 3.14.3s |
||
cisco ios xe 3.10.7s |
||
cisco ios xe 2.2.1 |
||
cisco ios xe 2.5.0 |
||
cisco ios xe 3.15.4s |
||
cisco ios xe 3.10.4s |
||
cisco ios xe 3.7.2s |
||
cisco ios xe 2.6.0 |
||
cisco ios xe 3.7.7s |
||
cisco ios xe 2.4.3 |
||
cisco ios xe 3.1.0s |
||
cisco ios xe 2.4.0 |
||
cisco ios xe 3.10.5s |
||
cisco ios xe 3.4.0as |
||
cisco ios xe 3.15.3s |
||
cisco ios xe 3.7.4s |
||
cisco ios xe 3.12.2s |
||
cisco ios xe 3.1.2s |
||
cisco ios xe 3.15.0s |
||
cisco ios xe 3.10.6s |
||
cisco ios xe 3.9.0s |
||
cisco ios xe 3.11.2s |
||
cisco ios xe 3.1.3as |
||
cisco ios xe 3.16.3s |
||
cisco ios xe 3.5.2s |
||
cisco ios xe 3.12.3s |
||
cisco ios xe 3.2.2s |
||
cisco ios xe 3.8.1s |
||
cisco ios xe 3.10.3s |
||
cisco ios xe 2.3.1t |
||
cisco ios xe 3.9.2s |
||
cisco ios xe 3.14.0s |
||
cisco ios xe 3.7.4as |
||
cisco ios xe 3.5.1s |
||
cisco ios xe 3.13.4s |
||
cisco ios xe 3.16.2s |
||
cisco ios xe 2.6.1 |
||
cisco ios xe 3.9.1s |
||
cisco ios xe 3.14.1s |
||
cisco ios xe 3.10.2s |
||
cisco ios xe 3.12.1s |
||
cisco ios xe 3.13.6s |
||
cisco ios xe 3.4.3s |
||
cisco ios xe 3.11.4s |
||
cisco ios xe 3.14.2s |
||
cisco ios xe 3.15.2s |
||
cisco ios xe 3.16.5s |
||
cisco ios xe 3.2.0s |
||
cisco ios xe 3.13.1s |
||
cisco ios xe 3.15.1s |
||
cisco ios xe 2.3.2 |
||
cisco ios xe 3.4.5s |
||
cisco ios xe 3.7.6s |
||
cisco ios xe 3.6.2s |
||
cisco ios xe 3.1.1s |
||
cisco ios xe 3.6.1s |
||
cisco ios xe 3.13.6as |
||
cisco ios xe 2.2.0 |
||
cisco ios xe 3.17.0s |
||
cisco ios xe 3.13.0s |
||
cisco ios xe 3.11.3s |
Nine SNMP MIBs vulnerable
Cisco's been caught out by the venerable Simple Network Management Protocol, turning up nine bugs in IOS and IOS XE that appear in all SNMP versions. Its implementation of SNMP v1, v2c and v3 – in other words, all versions in use – has a buffer overflow condition that in the right conditions can be exploited for denial-of-service and remote code execution. The two older versions are vulnerable if an attacker knows a network's read-only SNMP community string; SNMP v3 is only vulnerable if a...
Vulmon