ExploitedIn CISA KEV

CVE-2017-3881

Exploitation confirmed. First attested on 2022-03-25 by CISA-ADP, CISA KEV, GCVE · kevintel.

Published2017-03-17
WeaknessCWE-20

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.

Timeline

dates in UTC

2017-03-1722:59CVE publishedNVD
2022-03-25Listed as exploited by GCVEGCVE
2022-03-25Exploitation first reportedCISA KEV
2022-03-25Added to the CISA KEV catalogCISA KEV
2024-11-0816:05SSVC exploitation set to activeCISA-ADP
2026-10-2319:23First public proof of conceptPoC-in-GitHub
2026-10-2319:23EPSS crossed 10 %FIRST EPSS

Observed activity

isMalicious corpus · updated 2026-10-23 18:48 UTC

Indicators tagged with this CVE, per day0 indicators over 7 days

Block these indicators

Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2017-3881?format=txt
CSV export: https://api.ismalicious.com/edl/cve/CVE-2017-3881?format=csv
TAXII collection of exploited CVEs
The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD

Cisco iosversion to verify

Branch	Affected	Fixed in	Source
15.1	≥ 12.2s, ≤ 15.1\(3\)svs	no fix published	NVD

Cisco ios xeversion to verify

Branch	Affected	Fixed in	Source
3.x	≥ 3.2sg, ≤ 3.9e	no fix published	NVD

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

ICSA-17-094-03 CISA5 known affected
Rockwell Automation Allen-Bradley Stratix and Allen-Bradley ArmorStratix
Allen-Bradley Stratix 8000 Modular Managed Industrial Ethernet Switches: All Versions 15.2(5)EA.fc4 and earlier · Allen-Bradley Stratix 8300 Modular Managed Industrial Ethernet Switches: All Versions 15.2(4a)EA5 and earlier · Allen-Bradley Stratix 5400 Industrial Ethernet Switches: All Versions 15.2(5)EA.fc4 and earlier · +2 more

Full record on NVD

Fix

CISA’s required action: Apply updates per vendor instructions.due 2022-04-15
Mitigation from the vendor CISA ICSA-17-094-03 · 5 productsRockwell Automation has provided interim compensating controls for Allen-Bradley Stratix and ArmorStratix switches to help reduce the risk of exploitation of the vulnerability identified in the Cisco Cluster Management Protocol (CMP) processing code used in the Cisco IOS and Cisco IOS XE software. …
Mitigation from the vendor CISA ICSA-17-094-03 · 5 productsDisable the Telnet protocol as an allowed protocol for incoming connections on affected devices to diminish the network-based vector of attack. For information on how to disable Telnet via Command Line Interface, please see Knowledgebase Article ID 1040270, which is available at the following locat…
Mitigation from the vendor CISA ICSA-17-094-03 · 5 productsIf a user is unable or unwilling to disable Telnet, then implementing infrastructure access control lists (iACLs) can reduce the attack service. For information on how to implement iACLs, please see Knowledgebase Article ID 1040270.
Mitigation from the vendor CISA ICSA-17-094-03 · 5 productsCisco has created two Snort rules (SIDs), 41909 and 41910, to detect exploits associated with this vulnerability.
Mitigation from the vendor CISA ICSA-17-094-03 · 5 productsRockwell Automation security advisory, Stratix CMP Remote Code Execution Vulnerability, is available at the following location (with a valid account):
Mitigation from the vendor CISA ICSA-17-094-03 · 5 productsCisco's security advisory, Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability, is available at the following location:

Advisories and patches

tools.cisco.comVendor Advisory

Detection

read 2026-10-23 19:23 UTC

Nuclei template: none so far
Exploit-DB: no entry
Proof-of-concept repositories: 5 repositories, unverifiedartkond/cisco-rcehomjxi0e/CVE-2017-3881-exploit-cisco-homjxi0e/CVE-2017-3881-Ciscomzakyz666/PoC-CVE-2017-38811337g/CVE-2017-3881

CISA Known Exploited Vulnerability

Date Added: 2022-03-25
Patch Due Date: 2022-04-15
Ransomware Use: Unknown
Required Action: Apply updates per vendor instructions.

Sources

CISA KEVKEV entry2022-03-25
GCVEexploitation2022-03-25
CISA-ADPSSVC decisionactive2024-11-08
OpenCVESSVC decisionactive—
CISA-ADPCVSS 3.19.82024-11-08
NVDCVSS 3.19.8read 2026-10-23
NVDCVSS 2.010read 2026-10-23
CISA-ADPweakness (CWE)CWE-202024-11-08
NVDweakness (CWE)CWE-20read 2026-10-23
FIRST EPSSEPSS score99.0 %read 2026-10-23
PoC-in-GitHubproof of concept5read 2026-10-23

Technical details

CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2017-03-17
Last Modified: 2026-06-17
NVD status: Analyzed

Frequently asked questions

What is CVE-2017-3881?

Is CVE-2017-3881 actively exploited?

Yes. CVE-2017-3881 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2022-04-15.

What is the CVSS score for CVE-2017-3881?

CVE-2017-3881 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this product CISA KEV additions, March 2022 Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

For a threat intelligence platform: malware, C2 and ransomware indicators over STIX/TAXII.
Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database