Forwarded by the National Information Security Information Sharing and Analysis Center (NISAC-200-202508-00000021)

[Description]
Researchers have discovered buffer overflow vulnerabilities (CVE-2017-6736 to CVE-2017-6744) in the SNMP functionality of Cisco IOS and IOS XE Software. These vulnerabilities allow remote attackers who have obtained the SNMP community string to execute arbitrary code on the device. This series of vulnerabilities was disclosed in 2017 and added to the KEV list in 2022. Information on affected products and mitigation measures has recently been updated. Please verify and patch them as soon as possible.

[Affected Platforms]
All devices using Cisco IOS and IOS XE Software with SNMP enabled

[Recommended Actions]
1. An official update has been released to fix the vulnerability. Please refer to the official instructions for updating:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp

You can use the Cisco Software Checker (https://sec.cloudapps.cisco.com/security/center/softwarechecker.x) to determine if your current Cisco IOS and IOS XE Software versions are affected.

[References]
1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp
2. https://nvd.nist.gov/vuln/detail/cve-2017-6736
3. https://nvd.nist.gov/vuln/detail/cve-2017-6737
4. https://nvd.nist.gov/vuln/detail/cve-2017-6738
5. https://nvd.nist.gov/vuln/detail/cve-2017-6739
6. https://nvd.nist.gov/vuln/detail/cve-2017-6740
7. https://nvd.nist.gov/vuln/detail/cve-2017-6741
8. https://nvd.nist.gov/vuln/detail/cve-2017-6742
9. https://nvd.nist.gov/vuln/detail/cve-2017-6743
10. https://nvd.nist.gov/vuln/detail/cve-2017-6744