EUVD-2026-53449
GHSA-rxc8-wwjf-p7fp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
SNMP is network-accessible (AV:N); valid credentials required (PR:L); device reload cascades to downstream network (S:C); no confidentiality or integrity impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper error handling when parsing SNMP requests. This vulnerability affects all versions of SNMP — Versions 1, 2c, and 3. An attacker could exploit this vulnerability by sending a malformed SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly. The attacker must have the SNMPv1 or v2c read-only or read-write community string or valid SNMPv3 user credentials on the affected device.
AnalysisAI
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected device to reload by sending a malformed SNMP request, disrupting all traffic transiting the device. The vulnerability spans all three SNMP protocol versions (1, 2c, and 3) and affects an exceptionally broad version range across both the 3.x, 16.x, and 17.x release trains. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess at least one of the following valid credential types on the targeted device: an SNMPv1 or SNMPv2c read-only or read-write community string, or a valid SNMPv3 username with associated authentication and privacy parameters as configured on the device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 score is driven by network accessibility (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), no user interaction (UI:N), and a scope change (S:C) with high availability impact (A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a valid SNMPv2c read-only community string - through credential reuse, network sniffing on an unencrypted management VLAN, or configuration exposure - sends a specially crafted malformed SNMP GetRequest or GetNextRequest packet to UDP port 161 on a vulnerable Cisco IOS XE device. The SNMP parser encounters an error it cannot handle, triggering an uncontrolled process or system reload. … |
| Remediation | Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-snmp-dos-ZAqNm4MD for specific fixed software release versions, as exact patched version numbers are not confirmed in the available input data and must be verified directly from Cisco. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco IOS XE devices in production and identify which are running affected versions (3.x, 16.x, or 17.x trains) with SNMP enabled; also document SNMP access restrictions and current authentication controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attac
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today