{"cve":"CVE-2017-3849","nvd":{"published":"2017-03-21T16:59:00.227","modified":"2026-06-17T01:19:02.720","status":"Modified","description":"A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS Software (possibly 15.2 through 15.6) and Cisco IOS XE Software (possibly 3.7 through 3.18, and 16) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to incomplete input validation on certain crafted packets. An attacker could exploit this vulnerability by sending a crafted autonomic network channel discovery packet to a device that has all the following characteristics: (1) running a Cisco IOS Software or Cisco IOS XE Software release that supports the ANI feature; (2) configured as an autonomic registrar; (3) has a whitelist configured. An exploit could allow the attacker to cause the affected device to reload. Note: Autonomic networking should be configured with a whitelist. Do not remove the whitelist as a workaround. Cisco Bug IDs: CSCvc42717.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","score":7.4},"cwes":["CWE-20"],"references":["http://www.securityfocus.com/bid/96972","http://www.securitytracker.com/id/1038064","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170320-ani","http://www.securityfocus.com/bid/96972","http://www.securitytracker.com/id/1038064"],"products":["cisco:ios","cisco:ios_xe"],"source":"nvd","synced_at":"2026-10-19T20:42:09.859288039+00:00"},"epss":{"cve":"CVE-2017-3849","score":0.00761,"percentile":0.55317,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}