Summary

• A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to poll an affected device using SNMP, even if the device is configured to deny SNMP traffic from an unauthorized source or the SNMPv3 username is removed from the configuration.

  This vulnerability exists because of the way that the SNMPv3 configuration is stored in the Cisco IOS Software and Cisco IOS XE Software startup configuration. An attacker could exploit this vulnerability by polling an affected device from a source address that should have been denied. A successful exploit could allow the attacker to perform SNMP operations from a source that should be denied.

  Note: The attacker has no control of the SNMPv3 configuration. To exploit this vulnerability, the attacker must have valid SNMPv3 user credentials.

  For more information, see the Details section of this advisory.

  Cisco has not released software updates that address this vulnerability. However, there is a new method for configuring SNMPv3 so that it will not be affected by this vulnerability. There are workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmpv3-qKEYvzsy

  This advisory is part of the May 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.

Affected Products

• Vulnerable Products

  At the time of publication, this vulnerability affected all releases of Cisco IOS and IOS XE Software if the SNMPv3 feature was configured.

  See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

  Determine the Device Configuration

  To determine if a device has an affected configuration, use the mapping table in the Details section of this advisory. If the length of the configuration line exceeds 255 characters, the device is affected.

  Administrators can also check the output of show snmp user username to see if the access-list name is defined as expected. For example, an administrator could configure a device as follows:

  Router# configure terminal
  Router(config)#snmp-server user SNMP256 SNMPV3_READ v3 auth sha auth1234567890xxxxx priv aes 256 encr1234567890xxxxx access ACL-EXAMPLE-ALLOW_SNMP
  Router(config)#end
  Router#show snmp user SNMP256
  User name: SNMP256
  Engine ID: 80000009030074A2E6831A01
  storage-type: nonvolatile        active access-list: ACL-EXAMPLE-ALLOW_SNMP
  Authentication Protocol: SHA
  Privacy Protocol: AES256
  Group-name: SNMPV3_READ
  
  Router#

  In the preceding example, everything appears normal, and the system would function correctly. However, if the system reloaded, upon starting it back up and using the same command, the administrator would see the following output:

  Router#show snmp user SNMP256
  User name: SNMP256
  Engine ID: 80000009030074A2E6831A01
  storage-type: nonvolatile	 active	access-list: ACL-EXAMPLE-ALLOW_S
  Authentication Protocol: SHA
  Privacy Protocol: AES256
  Group-name: SNMPV3_READ
  Router#

  In the preceding example, the access control list (ACL) name has been truncated. Because the ACL name does not exist in the configuration, it will not be enforced, leaving the SNMPv3 user without an ACL.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that this vulnerability does not affect the following Cisco products:

  • IOS XR Software
  • Meraki products
  • NX-OS Software

Details

• When an administrator configures an SNMPv3 user on the configuration CLI and saves the configuration, it is written to a startup configuration file. The strings for both authentication and privacy protocols are converted to fixed-length octets that are separated by colons. A keyword, encrypted, is also added.

  This can dramatically increase the length of the stored configuration, as shown in the following table:

  Auth:      MD5:    47 char to store      
             SHA1:   59 char to store      
             SHA256: 71 char to store      
             SHA384: 95 char to store      
             SHA512: 143 char to store       
  
  Priv:      3DES:   95 char to store
             AES128: 47 char to store
             AES192: 71 char to store
             AES256: 95 char to store      

  If, after the conversion to octets, the configuration line exceeds 255 characters, it may be truncated or not accepted when it is read back into the running configuration after a device reload.

  For example, the SNMPv3 configuration could be as follows:

  snmp-server user SNMP256 SNMPV3_READ v3 auth sha auth1234567890xxxxx priv aes 256 encr1234567890xxxxx access ACL-EXAMPLE-ALLOW_SNMP

  The SNMPv3 configuration would be transposed to the following in the startup configuration (octets intentionally left as 00):

  snmp-server user SNMP256 SNMPV3_READ v3 encrypted auth sha 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 priv aes 256 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 access  ACL-EXAMPLE-ALLOW_SNMP

  The startup configuration in this example is 258 characters, which exceeds the 255 limit. Upon reload, the last three characters of the configuration string would be removed, resulting in an incorrect ACL configuration. This means no ACL is applied.

Workarounds

• There is a workaround that addresses this vulnerability.

  To ensure that the SNMPv3 configuration that is written to the startup configuration is 255 characters or less, use one of the following methods:

  • Move the IPv4 ACL name, the IPv6 ACL name, or both to be attached to the SNMPv3 group name instead of being attached to the username.
  • Shorten the combination of the user, group, and ACL names.

  While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Fixed Software

• When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

  Fixed Releases

  Cisco does not plan to release a fix that addresses this vulnerability.

  However, Cisco IOS XE Software releases 17.15.3 and 17.17.1 introduce a new method of configuring SNMPv3 that uses type 6 encryption, so the user configuration is visible in the CLI, which gets around the limitation that is described in this advisory. Upgrading to Release 17.15.3 or Release 17.17.1 will not automatically convert the SNMPv3 configuration. Administrators must reconfigure SNMPv3 using type 6 encryption, as shown in the following example:

  Router#configure terminal
  Router(config)#password encryption aes
  Router(config)#key config-key password-encrypt Example!23
  Router(config)#do show run | include snmp
  Router(config)#snmp-server user test gp v3 auth sha-2 512 0 cisco1234 priv aes 128 0 cisco1234
  Router(config)#do show run | include snmp                                                     
  snmp-server user test gp v3 auth sha-2 512 6 GhN\ieUbTWDHFZigBYOB\eROcbV\]RLXfAAB priv aes 128 6 S`bUVJWXiYbfKMf[Vd_]_LVhSHJFghUSNAAB 
  Router(config)#snmp-server user testUser1 PSIRTGroup v3 auth sha-2 512 0 cisco1234 priv aes 128 0 cisco1234 access ipv6 IPV6_ACL_SNMP
  Router(config)#do sho run | include snmp
  snmp-server user test gp v3 auth sha-2 512 6 GhN\ieUbTWDHFZigBYOB\eROcbV\]RLXfAAB priv aes 128 6 S`bUVJWXiYbfKMf[Vd_]_LVhSHJFghUSNAAB 
  snmp-server user testUser1 PSIRTGroup v3 auth sha-2 512 6 RJ^DfTEg[TRTBbFHTK\fcaGPdB]ZENXFGAAB priv aes 128 6 bfcMY[QGYZKPSdHKc_`eOEeEKUbD]KEbEAAB access ipv6 IPV6_ACL_SNMP
  Router(config)#

Recommendations

• Customers who are using SNMPv3 should validate the configuration to ensure it does not exceed the 255-character limit.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• This vulnerability was found during the resolution of a Cisco TAC support case.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmpv3-qKEYvzsy

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	-	Final	2025-MAY-07

  Show Less