{"id":"CVE-2017-3881","published":"2017-03-17T22:59:00Z","modified":"2026-06-17T01:19:06Z","title":"Cisco IOS and IOS XE Remote Code Execution Vulnerability","vendor":"Cisco","product":"IOS and IOS XE","tier":"core","eol":null,"description":{"text":"A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the Cisco Cluster Management Protocol processing code in Cisco IOS and IOS XE Software allows malformed CMP-specific Telnet options to be accepted and processed over any Telnet connection, not just internal cluster communication. An unauthenticated remote attacker who can open a Telnet session to an affected device configured to accept Telnet connections can send such malformed options to cause a device reload or execute arbitrary code with elevated privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:03:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9895,"percentile":0.99928,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-3881","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-03-17","exploitedFirstSeen":"2017-03-17","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2017-03-17"},{"url":"https://www.alertlogic.com/blog/ironically-positive-fallout-from-vault-7-cisco-vault-7-cve-2017-3881-d48/","date":"2017-03-23"},{"url":"https://blog.talosintelligence.com/2019/04/seaturtle.html","date":"2019-04-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://www.trendmicro.com/en_us/research/25/j/operation-zero-disco-cisco-snmp-vulnerability-exploit.html","date":"2025-10-15"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://www.securityfocus.com/bid/96960","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/97391","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038059","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/41872/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41874/","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/96960","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/97391","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038059","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/41872/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41874/","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3881","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Remote unauthenticated exploit against exposed Telnet service","mappingType":"uncategorized","evidence":[{"from":"description","quote":"An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session","start":736,"end":865}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution on the device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could allow an attacker to execute arbitrary code and obtain full control of the device","start":948,"end":1035}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Device reload causes application or system DoS","mappingType":"primary_impact","evidence":[{"from":"description","quote":"or cause a reload of the affected device","start":1036,"end":1076}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-65ab06ae92274f14e50e","title":"DNS Hijacking Abuses Trust In Core Internet Service","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/seaturtle/","date":"2019-04-17","mentions":[{"quote":"CVE-2017-3881: RCE by unauthenticated user with elevated privileges Cisco switches","start":8734,"end":8816},{"quote":"GNU bash system, specific the SMTP (this was part of the Shellshock CVEs)SID: 31975 - 31978, 31985, 32038, 32039, 32041 - 32043, 32069, 32335, 32336CVE-2017-3881: RCE for Cisco switchesSID: 41909 - 41910CVE-2017-6736: Remote Code Exploit (RCE) for Cisco integrated Service Router 2811SID: 43424 -","start":20131,"end":20427}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-12998","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-12998","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":41872,"url":"https://www.exploit-db.com/exploits/41872","title":"Cisco Catalyst 2960 IOS 12.2(55)SE11 - 'ROCEM' Remote Code Execution","type":"remote","platform":"hardware","date":"2017-04-12","verified":false,"provenance":"source"},{"id":42122,"url":"https://www.exploit-db.com/exploits/42122","title":"Cisco Catalyst 2960 IOS 12.2(55)SE1 - 'ROCEM' Remote Code Execution","type":"remote","platform":"hardware","date":"2017-04-12","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-04-12"},"pocGithub":{"count":4,"skipped":1,"earliest":"2017-04-10","earliestUrl":"https://github.com/artkond/cisco-rce","repos":[{"name":"artkond/cisco-rce","url":"https://github.com/artkond/cisco-rce","stars":213,"created":"2017-04-10"},{"name":"homjxi0e/CVE-2017-3881-exploit-cisco-","url":"https://github.com/homjxi0e/CVE-2017-3881-exploit-cisco-","stars":2,"created":"2017-04-20"},{"name":"1337g/CVE-2017-3881","url":"https://github.com/1337g/CVE-2017-3881","stars":2,"created":"2018-01-02"},{"name":"mzakyz666/PoC-CVE-2017-3881","url":"https://github.com/mzakyz666/PoC-CVE-2017-3881","stars":1,"created":"2017-05-11"}]},"metasploit":[{"name":"Cisco IOS Telnet Denial of Service","module":"auxiliary/dos/cisco/ios_telnet_rocem","type":"auxiliary","disclosureDate":"2017-03-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/cisco/ios_telnet_rocem.rb"}],"nuclei":[{"id":"CVE-2017-3881","name":"Cisco IOS 12.2(55)SE11 - Remote Code Execution","severity":"critical","path":"network/cves/2017/CVE-2017-3881.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2017/CVE-2017-3881.yaml"}],"first":{"date":"2017-03-17","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/cisco/ios_telnet_rocem.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/41872/","https://www.exploit-db.com/exploits/41874/"],"flow":[{"stage":"primary","techniques":["T1059","T1499.004"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source"}],"timeline":[{"date":"2017-03-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3881","provenance":"source"},{"date":"2017-03-17","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2017-04-10, Exploit-DB 2017-04-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/cisco/ios_telnet_rocem.rb","provenance":"source"},{"date":"2017-03-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2019-04-17","kind":"report","label":"Named in blog.talosintelligence.com: DNS Hijacking Abuses Trust In Core Internet Service","url":"https://blog.talosintelligence.com/seaturtle/","provenance":"machine"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-12998","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1834},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3513 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 NVD exploit link; 4 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-cisco-ios-and-ios-xe-cwe-20"}}