Actively exploited · Published Aug 7, 2017 · Assigned by cisco

CVE-2017-6663

Medium 6.5 Exploited

In plain English

A medium-severity security flaw in Cisco IOS and IOS XE. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)2.1%top 18.1% of all CVEs

Exploited in the wildYesCISA KEV since Mar 3, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 24, 2022.

Official description

A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in a denial of service (DoS) condition. More Information: CSCvd88936. Known Affected Releases: Denali-16.2.1 Denali-16.3.1.

Affected products (as reported)

Vendor	Product	Versions
n/a	Cisco IOS and IOS XE	Cisco IOS and IOS XE

References

1038999 vdb-entry, x_refsource_SECTRACK
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170726-anidos x_refsource_CONFIRM
99973 vdb-entry, x_refsource_BID
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6663 government-resource