cisco-sa-iosxe-snmp-dos-ZAqNm4MDHighCVSS 7.7

Cisco IOS XE Software SNMP Denial of Service Vulnerability

Published
August 5, 2026
Last Modified
August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-20124 →

📋 Description

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.

This vulnerability is due to improper error handling when parsing SNMP requests. This vulnerability affects all versions of SNMP — Versions 1, 2c, and 3. An attacker could exploit this vulnerability by sending a malformed SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly. The attacker must have the SNMPv1 or v2c read-only or read-write community string or valid SNMPv3 user credentials on the affected device.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. There is a mitigation that addresses this vulnerability.

CVE-2026-20124 — Cisco IOS XE Software SNMP Denial of Service Vulnerability (CVSS 3.1 7.7, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

🎯 Affected products286

  • Cisco IOS XE Software
  • Cisco IOS XE Software 16.10.1
  • Cisco IOS XE Software 16.10.1a
  • Cisco IOS XE Software 16.10.1b
  • Cisco IOS XE Software 16.10.1c
  • Cisco IOS XE Software 16.10.1d
  • Cisco IOS XE Software 16.10.1e
  • Cisco IOS XE Software 16.10.1f
  • Cisco IOS XE Software 16.10.1g
  • Cisco IOS XE Software 16.10.1s
  • Cisco IOS XE Software 16.10.2
  • Cisco IOS XE Software 16.10.3
  • Cisco IOS XE Software 16.11.1
  • Cisco IOS XE Software 16.11.1a
  • Cisco IOS XE Software 16.11.1b
  • Cisco IOS XE Software 16.11.1c
  • Cisco IOS XE Software 16.11.1s
  • Cisco IOS XE Software 16.11.2
  • Cisco IOS XE Software 16.12.1
  • Cisco IOS XE Software 16.12.10
  • Cisco IOS XE Software 16.12.10a
  • Cisco IOS XE Software 16.12.11
  • Cisco IOS XE Software 16.12.12
  • Cisco IOS XE Software 16.12.13
  • Cisco IOS XE Software 16.12.14
  • Cisco IOS XE Software 16.12.15
  • Cisco IOS XE Software 16.12.1a
  • Cisco IOS XE Software 16.12.1c
  • Cisco IOS XE Software 16.12.1s
  • Cisco IOS XE Software 16.12.1t
  • +256 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability. However, there is a mitigation. Administrators can disable the affected OIDs on a device. Not all software will support the OID that is listed in the mitigation. If the OID is not valid for specific software, then it is not affected by this vulnerability. Excluding these OIDs may affect device management through SNMP, such as discovery and hardware inventory. To create or update a view entry and disable the affected OIDs, use the snmp-server view global configuration command, as shown in the following example: !Standard VIEW and Security Exclusions snmp-server view NO_BAD_SNMP iso included snmp-server view NO_BAD_SNMP snmpUsmMIB excluded snmp-server view NO_BAD_SNMP snmpVacmMIB excluded snmp-server view NO_BAD_SNMP snmpCommunityMIB excluded !End Standard View !Advisory Specific Mappings !CISCO-IETF-DHCP-SERVER-MIB Subnet Information snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetMask excluded snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetSharedNetworkName excluded snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetFreeAddrLowThreshold excluded snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetFreeAddrHighThreshold excluded snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetFreeAddresses excluded snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetStartAddress excluded snmp-server view NO_BAD_SNMP cDhcpv4ServerSubnetEndAddress excluded !End Advisory Specific Mappings To then apply this configuration to a community string, use the following command: snmp-server community mycomm view NO_BAD_SNMP RO For SNMPv3, use the following command: snmp-server group v3group v3 auth read NO_BAD_SNMP write NO_BAD_SNMP For customers using Meraki cloud-managed switches: For any devices in the dashboard organization that are running an affected software release, contact the Meraki support team to apply the recommended mitigation until fixed software becomes available. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

🔗 References (2)