Yes. CISA added CVE-2017-6740 to its Known Exploited Vulnerabilities catalogue on 3 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
What “exploited in the wild” means for a Cisco IOS and IOS XE SNMP CVE
For a CVE like this, “exploited in the wild” is not a theoretical label, it means the vulnerability has moved from lab proof to active abuse against real systems. The practical question is whether your Cisco IOS or IOS XE estate is exposed through SNMP, whether the vulnerable condition is present, and whether the asset has already been contacted or altered through an unauthorised management path.
That matters because network infrastructure flaws are often leveraged for direct code execution, reboots, or foothold creation on devices that sit at the centre of routing, segmentation, and remote administration. For edge appliances, the right comparison is not just patch status, but whether the management surface is reachable and whether the device is already part of a wider exposure pattern described in the Edge Device Security Guide.
How to confirm exposure without waiting for compromise
Start by inventorying every Cisco IOS and IOS XE system that exposes SNMP, directly or through management networks that are broader than intended. Then verify the device role, the management plane reachability, and whether the system is in a class of infrastructure where unauthorised code execution would have outsized impact. If you cannot quickly prove the absence of the affected subsystem or the vulnerable condition, treat the asset as exposed until the vendor advisory and CISA KEV entry say otherwise.
Use the vulnerability management process that combines asset scope, authenticated checks, KEV status, and remediation verification, rather than relying on generic network scanning alone. That approach is laid out in the Vulnerability Management Guide, which is especially relevant when a remotely exploitable issue touches a device management subsystem.
What to do if patching or remediation has to wait
If you cannot remediate immediately, reduce the attack surface around SNMP and management access. The key objective is to make exploitation harder, noisier, and more detectable: restrict who can reach the device, tighten management-plane access, remove unnecessary SNMP exposure, and monitor for abnormal reloads, configuration changes, or unexpected administrative activity. For network equipment, compensating controls are only credible when they actually narrow reachability, not when they simply document risk.
For a broader model of how public-facing appliances fail under active exploitation, the Zero-Day and Exploited Vulnerabilities Guide is useful because it frames the same emergency logic: triage quickly, reduce exposure, and assume that delay increases the chance of compromise.
Risk and Threat Considerations
Once a vulnerability is in CISA KEV, the concern shifts from “could this be used” to “how quickly might it be used again, and against which exposed devices.” With network infrastructure, a successful exploit can produce immediate control-plane impact, service interruption, or a persistent foothold that is difficult to distinguish from routine management traffic.
Failure mechanism: An authenticated remote attacker abuses the SNMP-related flaw to execute code or force a reload, turning a management function into an execution path on the device.
Impact: The result can be device takeover, outage, loss of routing integrity, or a position from which the attacker can observe or alter network traffic and management state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation requires rapid identification and remediation of exposed devices. |
| Recommendation — Prioritise exposed Cisco IOS and IOS XE systems for immediate remediation and verified exception handling. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE needs exposure discovery, triage, and verification on affected infrastructure. |
| SI-2 — Flaw Remediation | KEV-listed flaws demand timely remediation or compensating controls on production systems. | |
| CM-7 — Least Functionality | Reducing unnecessary SNMP exposure limits the reachable attack surface on network devices. | |
| Recommendation — Scan for vulnerable Cisco network devices and verify exposure before relying on patch status. Apply the vendor fix or approved mitigation quickly and document any temporary exception. Disable unnecessary SNMP access paths and restrict management interfaces to only required sources. | ||
| OWASP ASVS | V13 — Configuration | Management-plane exposure and unsafe defaults are configuration problems that raise exploitability. |
| Recommendation — Harden device configuration to remove unnecessary SNMP exposure and management access. | ||
Practitioner Guidance
What to verify: Confirm which Cisco IOS and IOS XE devices expose SNMP, whether those systems are reachable from untrusted or broad administrative networks, and whether any of them are business-critical edge devices with limited recovery tolerance.
Decision rule: If a device is internet-reachable, broadly reachable from user networks, or difficult to rebuild quickly, treat remediation as urgent and escalate patching or isolation ahead of routine maintenance windows.
What good looks like: You can prove the vulnerable surface is either removed, tightly constrained, or actively monitored, and you have evidence that the device has not been unexpectedly reloaded, reconfigured, or used as an access pivot.
Practitioner takeaway: For exploited network-device CVEs, the real question is not just whether the patch exists, but whether the management plane has enough exposure to let an attacker turn a single flaw into control of the device.
Related resources from NHI Mgmt Group
- CVE-2017-6740 (Cisco IOS and IOS XE Software SNMP Remote Code Execution)
- How do you patch or mitigate CVE-2017-6742 (Cisco IOS and IOS XE Software SNMP Remote Code Execution)?
- CVE-2017-6742 (Cisco IOS and IOS XE Software SNMP Remote Code Execution)
- CVE-2017-6743 (Cisco IOS and IOS XE Software SNMP Remote Code Execution)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org