{"id":"CVE-2017-6742","published":"2017-07-17T21:29:00Z","modified":"2026-06-17T01:22:56Z","title":"Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability","vendor":"Cisco","product":"IOS and IOS XE Software","tier":"core","eol":null,"description":{"text":"A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device. \r\n\r\n\r\n\r\nThe vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.\r\n\r\n\r\n\r\nOnly traffic directed to the affected system can be used to exploit this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"A buffer overflow in the SNMP implementation of Cisco IOS and IOS XE Software allows the flaw to be triggered on affected devices. An authenticated remote attacker who knows the SNMP read-only community string (SNMPv2c or earlier) or valid SNMPv3 user credentials can send a crafted SNMP packet to the device to reload it or execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:46Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.21424,"percentile":0.97601,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2023-04-19","dueDate":"2023-05-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp; https://nvd.nist.gov/vuln/detail/CVE-2017-6742","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-04-17","exploitedFirstSeen":"2023-04-17","ransomware":false,"evidence":[{"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20170629-snmp.html","date":"2023-04-17"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-108","date":"2023-04-18"},{"url":"https://www.ncsc.gov.uk/news/apt28-exploits-known-vulnerability-to-carry-out-reconnaissance-and-deploy-malware-on-cisco-routers","date":"2023-04-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-04-19"},{"url":"https://information.rapid7.com/rs/411-NAK-970/images/Rapid7-2023-Mid-Year-Threat-Review.pdf","date":"2023-08-17"},{"url":"https://www.logpoint.com/wp-content/uploads/2024/06/logpoint-etpr-forest-blizzard.pdf","date":"2024-05-31"},{"url":"https://www.cisa.gov/sites/default/files/2024-11/aa24-317a-2023-top-routinely-exploited-vulnerabilities.pdf","date":"2024-11-12"},{"url":"https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/2023-top-routinely-exploited-vulnerabilities","date":"2024-11-13"},{"url":"https://www.maverits.com/post/apt28-the-long-hand-of-russian-interests","date":"2025-01-25"},{"url":"https://blog.polyswarm.io/fancy-bear-leveraging-cve-2026-21509-in-operation-neusploit","date":"2026-02-09"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/99345","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038808","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6742","tags":["US Government Resource"]}],"techniques":[{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem. \nReported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as \"Jaguar Tooth\", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem. \nReported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as \"Jaguar Tooth\", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem. \nReported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as \"Jaguar Tooth\", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1542.005","name":"TFTP Boot","tactics":["persistence","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem. \nReported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as \"Jaguar Tooth\", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-15796","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-15796","exploited":true,"exploitedSince":"2023-04-19","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-01-17","earliestUrl":"https://github.com/sastraadiwiguna-purpleeliteteaming/Cisco-IOS-Exploitation-JAGUAR_TOOTH-CVE-2017-6742-Reconstruction","repos":[{"name":"sastraadiwiguna-purpleeliteteaming/Cisco-IOS-Exploitation-JAGUAR_TOOTH-CVE-2017-6742-Reconstruction","url":"https://github.com/sastraadiwiguna-purpleeliteteaming/Cisco-IOS-Exploitation-JAGUAR_TOOTH-CVE-2017-6742-Reconstruction","stars":0,"created":"2026-01-17"}]},"first":{"date":"2026-01-17","source":"PoC-in-GitHub","url":"https://github.com/sastraadiwiguna-purpleeliteteaming/Cisco-IOS-Exploitation-JAGUAR_TOOTH-CVE-2017-6742-Reconstruction"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1574"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1542.005","T1048"],"provenance":"source"}],"timeline":[{"date":"2017-07-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6742","provenance":"source"},{"date":"2023-04-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20170629-snmp.html","provenance":"source"},{"date":"2023-04-19","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-04-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-15796","provenance":"source"},{"date":"2026-01-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sastraadiwiguna-purpleeliteteaming/Cisco-IOS-Exploitation-JAGUAR_TOOTH-CVE-2017-6742-Reconstruction","provenance":"source"}],"speed":{"daysToPublicExploit":3106,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2102},"priority":{"score":68.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1291 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.52,"detail":"percentile 0.9760"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}