CVE-2017-6737

What Is Cisco IOS SNMP?

CVE-2017-6737 is one of multiple distinct buffer overflow vulnerabilities in the Cisco IOS and IOS XE SNMP subsystem disclosed in June 2017 advisory cisco-sa-20170629-snmp. Each CVE in this advisory (6736–6744) represents a separate OID-specific buffer overflow in the SNMP implementation. All affect devices with SNMP enabled and require SNMP authentication (community string or v3 credentials).

Overview

CVE-2017-6737 is a buffer overflow in a specific SNMP OID handler in Cisco IOS and IOS XE. An attacker with valid SNMP credentials can send a crafted SNMP packet referencing the vulnerable OID to execute code on the device or cause it to reload. All CVEs in advisory cisco-sa-20170629-snmp (6736–6744) are addressed by the same IOS software update. See CVE-2017-6736 for full context on this advisory and the SNMP exploitation context.

Affected Versions

Cisco IOS and IOS XE with SNMP enabled. Use cisco-sa-20170629-snmp and the Cisco IOS Software Checker for specific version identification.

Technical Details

CVE-2017-6737 is a buffer overflow (CWE-119) in the handler for a specific SNMP OID in the Cisco IOS SNMP subsystem. Exploitation requires a valid SNMP community string (SNMPv1/v2c) or SNMPv3 user credentials. A crafted SNMP packet targeting the vulnerable OID triggers the overflow, potentially enabling code execution or device reload.

Remediation

Apply Cisco IOS security update per cisco-sa-20170629-snmp — this advisory addresses all SNMP buffer overflow CVEs (6736–6744) in a single patch. Additionally:

1. Disable SNMP if not required (no snmp-server)
2. Use SNMPv3 with authpriv security level to replace community strings
3. Apply SNMP ACLs restricting access to trusted management hosts
4. Change all default SNMP community strings ("public", "private")