Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2017-3881

CVE-2017-3881CRITICAL

n/a Cisco IOS and IOS XE Software — Cisco IOS and IOS XE

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9895   99.9   YES

AFFECTED
  Product                        Versions                         Fixed
  Cisco IOS and IOS XE Software  Cisco IOS and IOS XE Software –  —

TIMELINE
  Dec 21  Reserved by cisco
  Mar 17  Published (CNA: cisco)
  Mar 25  Added to CISA KEV, remediation due 2022-04-15

CWE-20 · CNA: cisco · CVSS v3.1 · 7 references · KEV due April 15, 2022

Description

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 21, 2016	Reserved	Reserved by cisco
March 17, 2017	Published	Published (CNA: cisco)
March 25, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-04-15

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	Cisco IOS and IOS XE Software	—	Cisco IOS and IOS XE Software	—

Weaknesses

CWE-20

References (7)

http://www.securityfocus.com/bid/96960 [vdb-entry, x_refsource_BID]
http://www.securityfocus.com/bid/97391 [vdb-entry, x_refsource_BID]
http://www.securitytracker.com/id/1038059 [vdb-entry, x_refsource_SECTRACK]
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp [x_refsource_CONFIRM]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3881 [government-resource]
https://www.exploit-db.com/exploits/41872/ [exploit, x_refsource_EXPLOIT-DB]
https://www.exploit-db.com/exploits/41874/ [exploit, x_refsource_EXPLOIT-DB]

Authoritative record: CVE-2017-3881 at cve.org

Weaknesses: CWE-20

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2017-3881 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.