CVE-2017-3881A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected…
Updated under an hour ago ()
Does this affect you?
It affects cisco ios and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Mar 25, 2022; federal agencies had to remediate by Apr 15, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-20
- Known exploited
- Added to CISA KEV Mar 25, 2022; federal remediation due Apr 15, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 98.95% (percentile 100)
- Assigned by
- cisco
- NVD analysis
- Analyzed
- Record last updated
- Jan 12, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
cisco ios cisco:ios | from 12.2s through 15.1\(3\)svs | NVD |
cisco ios_xe cisco:ios_xe | from 3.2sg through 3.9e | NVD |
References
- https://www.exploit-db.com/exploits/41872/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
- https://www.exploit-db.com/exploits/41874/exploit, x-refsource-exploit-db, broken-link
- http://www.securityfocus.com/bid/97391vdb-entry, x-refsource-bid, third-party-advisory
- http://www.securityfocus.com/bid/96960vdb-entry, x-refsource-bid, third-party-advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmpx-refsource-confirm, vendor-advisory
- http://www.securitytracker.com/id/1038059vdb-entry, x-refsource-sectrack, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3881us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.