CVE-2017-6663KEV · OVERDUE

Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability

Medium · published August 7, 2017

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 81.6th percentile for exploit probability.

1673
days past CISA
deadline
CVSS v3.1
6.5
EPSS
2%
Percentile
81.6
In the wild
Confirmed
What it is

⚠️ A simple network meddler could trigger a reload of your Cisco devices without breaking a sweat! Think of it like a rogue neighbor who keeps pressing the elevator button repeatedly. Eventually, it leads to a frustrating halt, causing everyone to take the stairs instead. That’s exactly what this vulnerability does to your network! An unauthenticated, adjacent attacker can exploit this flaw to cause the autonomic nodes within your Cisco system to reload. The result? A denial of service (DoS) that can bring your network operations to a standstill, leaving users unable to access vital services.

Put simply

Think of it like a rogue neighbor who keeps pressing the elevator button repeatedly. Eventually, it leads to a frustrating halt, causing everyone to take the stairs instead. That’s exactly what this vulnerability does to your network! This vulnerability lies in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software. It enables unauthorized attackers to force a reload of the affected system's nodes, effectively disrupting normal operations without needing authentication.

What to do

An unauthenticated, adjacent attacker can exploit this flaw to cause the autonomic nodes within your Cisco system to reload. The result? A denial of service (DoS) that can bring your network operations to a standstill, leaving users unable to access vital services. To safeguard against this risk, update your Cisco devices to the latest version beyond Denali-16.2.1 and Denali-16.3.1. Regularly audit your network configurations to ensure only trusted adjacent devices are allowed access. You've got this! With a quick patch, you'll keep your network humming smoothly. 🛡️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02117 · 81.6th percentile
Published
2017-08-07T06:00Z
KEV added
2022-03-03 · due 2022-03-24
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 07 AUG 06:00Z
    A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause…
    cvelistv5