CVE-2017-6720 : What You Need to Know

Cisco Small Business Managed Switches SSH subsystem vulnerability

Understanding CVE-2017-6720

A security flaw in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software allows an authenticated remote attacker to trigger a denial of service (DoS) by causing a forced restart of the affected switch.

What is CVE-2017-6720?

The vulnerability arises from mishandling SSH connections, enabling an attacker to exploit the flaw by sending a harmful SSH message after gaining SSH access to the switch. Various Cisco products are impacted, including Small Business 300 Series Managed Switches, 500 Series Stackable Managed Switches, 350 Series Managed Switches, 350X Series Stackable Managed Switches, 550X Series Stackable Managed Switches, and ESW2 Series Advanced Switches.

The Impact of CVE-2017-6720

An authenticated remote attacker can force a restart of the affected switch, leading to a DoS situation.
The vulnerability affects multiple Cisco Small Business Managed Switches, potentially disrupting network operations.

Technical Details of CVE-2017-6720

A vulnerability in the SSH subsystem of Cisco Small Business Managed Switches software allows for a DoS attack.

Vulnerability Description

Improper handling of SSH connections leads to the vulnerability.
Attackers can exploit the flaw by sending malicious SSH messages after gaining SSH access to the switch.

Affected Systems and Versions

Small Business 300 Series Managed Switches
Small Business 500 Series Stackable Managed Switches
350 Series Managed Switches
350X Series Stackable Managed Switches
550X Series Stackable Managed Switches
ESW2 Series Advanced Switches

Exploitation Mechanism

Attackers need to gain SSH access to the switch and transmit a harmful SSH message to exploit the vulnerability.

Mitigation and Prevention

Immediate Steps to Take:

Disable SSH access if not required to mitigate the risk.
Monitor network traffic for any suspicious SSH activities. Long-Term Security Practices:
Regularly update the switch firmware to patch known vulnerabilities.
Implement network segmentation to limit the impact of potential attacks.
Train employees on secure SSH practices to prevent unauthorized access.
Conduct regular security audits to identify and address vulnerabilities.
Stay informed about security advisories and updates from Cisco.

Patching and Updates

Apply the latest firmware updates provided by Cisco to address the SSH vulnerability in Small Business Managed Switches.