Cisco IOS and IOS XE Software known exploited vulnerabilities, ranked
CISA lists 14 Cisco IOS and IOS XE Software CVEs as exploited in the wild. 0 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2017-6736: EPSS 70.4%, added 2022-03-03
- CVE-2017-6737: EPSS 45.2%, added 2022-03-03
- CVE-2017-6742: EPSS 21.4%, added 2023-04-19
- CVE-2018-0151: EPSS 14.2%, added 2022-03-03
- CVE-2017-12240: EPSS 13.8%, added 2022-03-03
All 14 Cisco IOS and IOS XE Software CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2017-6736 | IOS and IOS XE Software SNMP Remote Code Execution | 70.4% | – | 2022-03-03 | 2022-03-24 |
| 2 | CVE-2017-6737 | IOS and IOS XE Software SNMP Remote Code Execution | 45.2% | – | 2022-03-03 | 2022-03-24 |
| 3 | CVE-2017-6742 | IOS and IOS XE Software SNMP Remote Code Execution | 21.4% | – | 2023-04-19 | 2023-05-10 |
| 4 | CVE-2018-0151 | IOS Software and IOS XE Software Quality of Service Remote Code Execution | 14.2% | – | 2022-03-03 | 2022-03-17 |
| 5 | CVE-2017-12240 | IOS and IOS XE Software DHCP Remote Code Execution | 13.8% | – | 2022-03-03 | 2022-03-24 |
| 6 | CVE-2017-6740 | IOS and IOS XE Software SNMP Remote Code Execution | 11.1% | – | 2022-03-03 | 2022-03-24 |
| 7 | CVE-2017-6738 | IOS and IOS XE Software SNMP Remote Code Execution | 10.9% | – | 2022-03-03 | 2022-03-24 |
| 8 | CVE-2017-6739 | IOS and IOS XE Software SNMP Remote Code Execution | 10.9% | – | 2022-03-03 | 2022-03-24 |
| 9 | CVE-2017-6743 | IOS and IOS XE Software SNMP Remote Code Execution | 10.9% | – | 2022-03-03 | 2022-03-24 |
| 10 | CVE-2018-0172 | IOS and IOS XE Software Improper Input Validation | 7.8% | – | 2022-03-03 | 2022-03-17 |
| 11 | CVE-2018-0173 | IOS and IOS XE Software Improper Input Validation | 7.6% | – | 2022-03-03 | 2022-03-17 |
| 12 | CVE-2017-12237 | IOS and IOS XE Software Internet Key Exchange Denial-of-Service | 7.1% | – | 2022-03-03 | 2022-03-24 |
| 13 | CVE-2017-6627 | IOS Software and IOS XE Software UDP Packet Processing Denial-of-Service | 6.2% | – | 2022-03-03 | 2022-03-24 |
| 14 | CVE-2017-6663 | IOS Software and IOS XE Software Denial-of-Service | 2.1% | – | 2022-03-03 | 2022-03-24 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Cisco KEV CVEs · other Cisco products: Catalyst SD-WAN Manager · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) · IOS XR · Small Business RV160, RV260, RV340, and RV345 Series Routers · IOS software · free KEV badge for Cisco · all vendors