# CVE-2017-3881: Cisco IOS and IOS XE Remote Code Execution Vulnerability

Source: https://junglewise.ai/threats/cve-2017-3881-cisco-ios-and-ios-xe-remote-code-execution-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-25. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2017-3881 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-03-25

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and IOS XE Software allows an unauthenticated, remote attacker to execute arbitrary code with elevated privileges or cause a device reload. The flaw exists because CMP-specific Telnet options are incorrectly processed and accepted over any Telnet connection rather than being restricted to internal cluster communications.

Technologies: [Cisco IOS](https://junglewise.ai/threats/technologies/ios), [Cisco IOS XE](https://junglewise.ai/threats/technologies/ios-xe), [Cisco IOS XR](https://junglewise.ai/threats/technologies/ios-xr). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2017-3881 exploited in the wild?** Yes. CVE-2017-3881 is known to be exploited in the wild, first recorded on 25 March 2022. Treat it as urgent.

**How severe is CVE-2017-3881?** Critical severity, with a CVSS score of 9.8, published 25 March 2022.

**Which products and versions are affected?** Cisco IOS; Cisco IOS XE; Cisco Catalyst switches; Cisco Embedded Service 2020 switches; and 7 more.

**Is there a fix for CVE-2017-3881?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-3881 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2017-3881?** Check whether you run Cisco IOS, Cisco IOS XE or Cisco IOS XR. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Cisco IOS
- Cisco IOS XE
- Cisco Catalyst switches
- Cisco Embedded Service 2020 switches
- Cisco Enhanced Layer 2 EtherSwitch Service Module
- Cisco Enhanced Layer 2/3 EtherSwitch Service Module
- Cisco Gigabit Ethernet Switch Module (CGESM) for HP
- Cisco IE Industrial Ethernet switches
- Cisco ME 4924-10GE switch
- Cisco RF Gateway 10
- Cisco SM-X Layer 2/3 EtherSwitch Service Module

## Timeline

- 2017-03-17: advisory: Initial Cisco advisory published
- 2022-03-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2022-03-25: disclosed

## Related threats

- [Cisco IOS XR IPv4 packet processing denial of service](https://junglewise.ai/threats/cve-2026-76505-a-vulnerability-in-the-ipv4-packet-processing-functionality-of)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 out-of-bounds write](https://junglewise.ai/threats/cve-2026-20043-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco IOS XR Software improper neutralization in command processing](https://junglewise.ai/threats/cve-2026-20278-cisco-ios-xr-software-improper-neutralization-in-command)