CVE-2017-3876 Denial of service in Cisco IOS XR

High 7.5 Published 16 May 2017 Updated 5 Aug 2024

Unauthenticated remote attackers can crash Cisco IOS XR routers by sending repeated gRPC requests, requiring manual recovery.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-3876?

CVE-2017-3876 is a high-severity denial of service vulnerability in Cisco Ios Xr, published on 16 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this vulnerability by repeatedly sending unauthenticated gRPC requests to the affected device. A successful exploit could allow the attacker to crash the device in such a manner that manual intervention is required to recover. This vulnerability affects all Cisco IOS XR platforms that are running release 6.1.1 of Cisco IOS XR Software when the gRPC service is enabled on the device. The gRPC service is not enabled by default. Cisco Bug IDs: CSCvb14441.

Weakness: CWE-399

Which versions are affected by CVE-2017-3876?

It affects 1 product.

Products include Cisco Ios Xr.

How do I fix CVE-2017-3876?

No fix has been published for CVE-2017-3876 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-3876 being exploited?

There is no known exploitation of CVE-2017-3876 in the wild and no public exploit code.

All Cisco Ios Xr vulnerabilities

Sources

Also known as GHSA-hjx2-h94g-x4vv.