Summary

• A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.

  This vulnerability is due to improper error handling when parsing SNMP requests. This vulnerability affects all versions of SNMP - Versions 1, 2c, and 3. An attacker could exploit this vulnerability by sending a malformed SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly. The attacker must have the SNMPv1 or v2c read-only or read-write community string or valid SNMPv3 user credentials on the affected device.

  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. There is a mitigation that addresses this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-snmp-dos-ZAqNm4MD

Affected Products

• Vulnerable Products

  This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco IOS XE Software and have SNMP enabled.

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Determine the Device Configuration

  To determine whether a device has SNMPv1 or v2c enabled, use the show running-config | include snmp-server community CLI command. If there is output, SNMP is enabled, as shown in the following example:

  Router# show running-config | include snmp-server community
  snmp-server community public ro

  To determine whether a device has SNMPv3 enabled, use the show running-config | include snmp-server group and show snmp user CLI commands. If there is output from both commands, SNMPv3 is enabled, as shown in the following example:

  Router# show running-config | include snmp-server group
  snmp-server group v3group v3 noauth
  
  Router# show snmp user
  User name: remoteuser1
  Engine ID: 800000090300EE01E71C178C
  storage-type: nonvolatile     active
  Authentication Protocol: SHA
  Privacy Protocol: None
  Group-name: v3group

  
  

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that this vulnerability does not affect the following Cisco products:

  • IOS Software
  • IOS XR Software
  • NX-OS Software

Workarounds

• There are no workarounds that address this vulnerability.

  However, there is a mitigation. Administrators can disable the affected OIDs on a device. Not all software will support the OID that is listed in the mitigation. If the OID is not valid for specific software, then it is not affected by this vulnerability. Excluding these OIDs may affect device management through SNMP, such as discovery and hardware inventory.

  To create or update a view entry and disable the affected OIDs, use the snmp-server view global configuration command, as shown in the following example:

  !Standard VIEW and Security Exclusions
  snmp-server view NO_BAD_SNMP iso included
  snmp-server view NO_BAD_SNMP snmpUsmMIB excluded
  snmp-server view NO_BAD_SNMP snmpVacmMIB excluded
  snmp-server view NO_BAD_SNMP snmpCommunityMIB excluded
  !End Standard View 
  
  !Advisory Specific Mappings
  !CISCO-IETF-DHCP-SERVER-MIB Subnet Information
  snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetMask excluded
  snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetSharedNetworkName excluded
  snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetFreeAddrLowThreshold excluded
  snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetFreeAddrHighThreshold excluded
  snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetFreeAddresses excluded
  snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetStartAddress excluded
  snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetEndAddress excluded
  !End Advisory Specific Mappings

  To then apply this configuration to a community string, use the following command:

  snmp-server community mycomm view NO_BAD_SNMP RO

  For SNMPv3, use the following command:

  snmp-server group v3group v3 auth read NO_BAD_SNMP write NO_BAD_SNMP

  For customers using Meraki cloud-managed switches: For any devices in the dashboard organization that are running an affected software release, contact the Meraki support team to apply the recommended mitigation until fixed software becomes available.

  While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Fixed Software

• Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

  Cisco IOS and IOS XE Software

  To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”).

  To use the tool, go to the Cisco Software Checker page and follow the instructions. Alternatively, use the following form to determine whether a release is affected by any Cisco Security Advisory. To use the form, follow these steps:

  1. Choose which advisories the tool will search-only this advisory, only advisories with a Critical or High Security Impact Rating (SIR), or all advisories.
  2. Enter a release number-for example, 15.9(3)M2 or 17.3.3.
  3. Click Check.

  
  

  Only this advisory All Critical and High advisories All advisories

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• Cisco would like to thank the external researcher who reported this vulnerability.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-snmp-dos-ZAqNm4MD

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	-	Final	2026-AUG-05

  Show Less