6.5med
CVE-2017-6663KEVin critical feed
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacen…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.1 · CNA
CISA KEV
Yes
added 2022-03-03
EPSS
2.1%
percentile 82%
Public exploits
0
none known
Summary
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in a denial of service (DoS) condition. More Information: CSCvd88936. Known Affected Releases: Denali-16.2.1 Denali-16.3.1.
Known exploited (CISA KEV)
- Added
- 4 y ago
- Due date
- 2022-03-24 (4 y ago)
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- Cisco / IOS and IOS XE Software
- CISA name
- Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction (EPSS)
2.12% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 6.1 | AV:A/AC:L/Au:N/C:N/I:N/A:C |
Affected products
- n/a Cisco IOS and IOS XE
Classification
- Technology feeds
- Cisco IOS (RSS, critical only)
References
- securitytracker.com /id/1038999 · vdb-entry, x_refsource_SECTRACK, x_transferred
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20170726-anidos · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/99973 · vdb-entry, x_refsource_BID, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6663 · government-resource
Sources
- CVE List: CVE-2017-6663
- NVD: CVE-2017-6663
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.