Cloudanix VulnDB

CVE-2017-6627

High · 7.5 CISA KEV

CVSS

7.5

EPSS

6.2%

Published

Sep 7, 2017

CISA due date

Mar 24, 2022

Cloudanix analysis

Act now SSVC: Attend

Attackers can send certain network packets to specific older Cisco devices and cause them to stop forwarding traffic until the devices recover on their own.

Active In The Wild
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Unauthenticated remote attacker sends UDP packets to destination port 0, causing the device to create idle sockets that are never closed; UDP packets accumulate in the input interface queue until it wedges, resulting in denial of service until 250 packets are received.

Why it matters to the business

Network devices can be rendered unavailable, interrupting connectivity, management access, and dependent services; the issue is actively exploited in the wild with a past CISA remediation deadline of 2022-03-24.

How an attack unfolds

An attacker sends crafted UDP packets with destination port 0 to an affected Cisco IOS or IOS XE device; the software creates sockets that remain open and idle, causing the input queue to hold packets and wedge the interface, producing a DoS condition that persists until the queue drains after 250 packets.

How to fix it

Upgrade affected Cisco IOS 15.1/15.2/15.4 and IOS XE 3.14-3.18 releases to versions that properly close idle UDP sockets; apply the fixes referenced in Cisco Bug IDs CSCup10024, CSCva55744, and CSCva95506.

How to confirm the fix worked

Confirm the device is running a patched release, monitor interface queue counters for anomalous UDP packet accumulation on port 0, and verify that new UDP traffic no longer causes persistent queue wedging.

Typical attack path

  1. Identify reachable Cisco IOS or IOS XE device
  2. Send UDP packets with destination port 0 from any source
  3. Observe input queue wedge and resulting DoS on the target interface

How to detect it

Review network flow logs, firewall logs, and device interface statistics for repeated UDP packets destined to port 0; inspect syslog or SNMP traps indicating input queue utilization spikes or interface wedging on affected Cisco platforms.

  • UDP destination port 0
  • interface input queue wedge
  • CSCup10024
  • CSCva55744
  • CSCva95506

What your security team should do

  • Prioritize patching of all internet-facing and critical Cisco IOS/IOS XE devices given KEV listing and active exploitation
  • Block or rate-limit UDP traffic to port 0 at network perimeters where feasible
  • Implement monitoring for interface input queue anomalies and UDP port 0 traffic

The record

A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and a denial of service (DoS) condition. The vulnerability is due to Cisco IOS Software application changes that create UDP sockets and leave the sockets idle without closing them. An attacker could exploit this vulnerability by sending UDP packets with a destination port of 0 to an affected device. A successful exploit could allow the attacker to cause UDP packets to be held in the input interfaces queue, resulting in a DoS condition. The input interface queue will stop holding UDP packets when it receives 250 packets. Cisco Bug IDs: CSCup10024, CSCva55744, CSCva95506.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities