Skip to content
Fencer Vulns
medium 6.5

CVE-2017-6720 json

A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote…

published 2017-09-21 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-15774

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote attacker to cause a reload of the affected switch, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SSH connections. An attacker could exploit this vulnerability by logging in to an affected switch via SSH and sending a malicious SSH message. This vulnerability affects the following Cisco products when SSH is enabled: Small Business 300 Series Managed Switches, Small Business 500 Series Stackable Managed Switches, 350 Series Managed Switches, 350X Series Stackable Managed Switches, 550X Series Stackable Managed Switches, ESW2 Series Advanced Switches. Cisco Bug IDs: CSCvb48377.

Patch / fix

  • cisco sf302-08pp_firmware 1.4.8.06
  • cisco sf302-08mpp_firmware 1.4.8.06
  • cisco sg300-10pp_firmware 1.4.8.06
  • cisco sg300-10mpp_firmware 1.4.8.06
  • cisco sf300-24pp_firmware 1.4.8.06
  • cisco sf300-48pp_firmware 1.4.8.06
  • cisco sg300-28pp_firmware 1.4.8.06
  • cisco sf300-08_firmware 1.4.8.06
  • cisco sf300-48p_firmware 1.4.8.06
  • cisco sg300-10mp_firmware 1.4.8.06
  • cisco sg300-10p_firmware 1.4.8.06
  • cisco sg300-10_firmware 1.4.8.06
  • cisco sg300-28p_firmware 1.4.8.06
  • cisco sf300-24p_firmware 1.4.8.06
  • cisco sf302-08mp_firmware 1.4.8.06
  • cisco sg300-28_firmware 1.4.8.06
  • cisco sf300-48_firmware 1.4.8.06
  • cisco sg300-20_firmware 1.4.8.06
  • cisco sf302-08p_firmware 1.4.8.06
  • cisco sg300-52_firmware 1.4.8.06

Exploit prediction

1.40% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C

Affected products

  • n/a Cisco Small Business Managed Switches

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.