Cloudanix VulnDB

CVE-2017-6663

Medium · 6.5 CISA KEV

CVSS

6.5

EPSS

2.1%

Published

Aug 7, 2017

CISA due date

Mar 24, 2022

Cloudanix analysis

Act now SSVC: Attend

Attackers on the same network can crash certain older Cisco routers and switches, causing network outages until the devices are updated or the risky feature is turned off.

Active In The Wild
Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Unauthenticated adjacent attackers can send specially crafted autonomic networking packets that trigger a reload of affected Cisco IOS and IOS XE nodes.

Why it matters to the business

Unexpected device reboots disrupt network operations and availability for organizations still running vulnerable Cisco IOS or IOS XE releases; the issue remains on the CISA KEV list with a missed 2022 remediation deadline and continues to be exploited in the wild.

How an attack unfolds

An attacker on the same local network segment crafts and sends malicious autonomic networking messages to reachable nodes; the malformed traffic causes the nodes to reload, producing a denial-of-service condition. Active exploitation has been observed in the wild against unpatched Cisco IOS and IOS XE devices.

How to fix it

Upgrade Cisco IOS and IOS XE software to a release that addresses CSCvd88936. If an upgrade is not immediately possible, disable the Autonomic Networking feature on exposed devices.

How to confirm the fix worked

Confirm the software version is no longer listed in the Known Affected Releases for CSCvd88936 and verify that autonomic networking is either disabled or the device no longer accepts the previously triggering packets.

Typical attack path

  1. Gain adjacent network access to the target Cisco device
  2. Craft autonomic networking protocol packets that exploit the flaw
  3. Transmit the packets to the autonomic node
  4. Trigger reload and resulting service interruption

How to detect it

Review device logs and crash dumps for unexpected reloads associated with autonomic networking processing; look for adjacent-network-origin traffic patterns that coincide with node failures.

What your security team should do

  • Immediately inventory all Cisco IOS and IOS XE devices and prioritize upgrades for those still running Denali-16.2.1 or Denali-16.3.1
  • Apply available patches or disable Autonomic Networking on any remaining vulnerable systems
  • Monitor KEV guidance and ensure all devices are remediated despite the passed 2022 deadline

The record

A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in a denial of service (DoS) condition. More Information: CSCvd88936. Known Affected Releases: Denali-16.2.1 Denali-16.3.1.

Affected packages

Ecosystem Package Introduced Fixed