CASCACascade Atlas

Evidence dossier

CVE-2017-3881

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a…

Exploited in the wild (CISA KEV since Mar 25, 2022). NVD reports CVSS 3.1 9.8. EPSS estimates 99.0% exploit likelihood as of Oct 21, 2026.

87.9–89.2Priority evidence range
Evidence through Oct 22, 2026, 6:07 PM UTC

As of Oct 22, 2026

Normalized restatement

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.

State
PUBLISHED
Published
Mar 17, 2017
Updated
Jan 12, 2026
Evidence coverage
95%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    cisco

    Record text: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.

    Inspect raw assertion
    Field
    container
    Value
    A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Cisco IOS and IOS XE Remote Code Execution Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Cisco IOS and IOS XE Remote Code Execution Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 98.95% probability · 99.93th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.989500000000; percentile 0.999300000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Mar 25, 2022 · first observed Sep 1, 2026

Exploit likelihood98.95%

FIRST EPSS · score date Oct 21, 2026 · 99.9th percentile · first observed Oct 21, 2026

SeverityCVSS 9.8

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusLast verified source snapshot retained

The last verified source boundary remains in force for this claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
Review source contract
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Oct 22, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Oct 22, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Oct 22, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
ciscoOriginal assertion
Record text

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.

Inspect raw assertion
Field
container
Value
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Cisco IOS and IOS XE Remote Code Execution Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Cisco IOS and IOS XE Remote Code Execution Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

98.95% probability · 99.93th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.989500000000; percentile 0.999300000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
323Underlying assertions
323Canonical products
2Target assertions
321Constraint assertions

Grouped from 2 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

324 scope groups

cisco · source assertedn/aCisco IOS and IOS XE SoftwareDirect source scope
Affected: Cisco IOS and IOS XE Software
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "Cisco IOS and IOS XE Software"}]
NVD CPE · HARDWAREciscocatalyst_2350-48td-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-6671474382260349e447f0cac9d28a3f7cf97fe39299f41af78fecd5a0c10ce6Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2350-48td-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b7301cdf-48bb-4e4b-862a-28b2a742d67b
NVD CPE · HARDWAREciscocatalyst_2350-48td-sdEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-8ec24fa739624c940c8f1ee13c0bae7d8624eb46a3bd417298a6c03cd66c26acLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2350-48td-sd:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    409044ec-4b25-4c7f-b20f-26cd79eee49f
NVD CPE · HARDWAREciscocatalyst_2360-48td-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-56567496ffb2969bb9df7bfda775e0922a21f8683ebb141f024c1778e8d46391Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2360-48td-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    4533989c-ccdc-464a-ab68-29a752fa0759
NVD CPE · HARDWAREciscocatalyst_2918-24tc-cEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-9bb6d032af9d0f09c224bb1c025d9ddd8f80e8ba869405be1bbd55694f66f749Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2918-24tc-c:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    487a1994-9ff2-4f15-9f38-c5b5218221de
NVD CPE · HARDWAREciscocatalyst_2918-24tt-cEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-2f08aa01bb53f9cb6027e40ec0855473d8aef2d4a1bdc2578c9a6d0c7139cff0Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2918-24tt-c:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    234dd8af-d938-4e20-89fe-e34f54eff2f6
NVD CPE · HARDWAREciscocatalyst_2918-48tc-cEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-1b58368afce86583ec031ff08664c8ee9d83a5946e669b46bc093db534c2d783Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2918-48tc-c:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a546fa79-654c-4ce9-9f6b-8f49255500f8
NVD CPE · HARDWAREciscocatalyst_2918-48tt-cEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-5cf180f15e183126a86e68b780e764d302d2d3cd126243521d9887d9315e98dcLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2918-48tt-c:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    14e8f619-55ba-45e4-b75e-a64e9452f7ae
NVD CPE · HARDWAREciscocatalyst_2928-24tc-cEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-d65fcf9536e87373e3de06496d4411debae00d4c446a86b9689fc1652f0523bdLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2928-24tc-c:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    23ce5551-b4ed-4554-9012-09a7cf7a5d88
NVD CPE · HARDWAREciscocatalyst_2960-24lc-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-9df269662aa622405dbb579205bf557831d2ad5c615d00a3c797dc22535a4edeLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-24lc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b07f566d-bcac-44ec-ab37-6fa870d4aeda
NVD CPE · HARDWAREciscocatalyst_2960-24lt-lEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-822b575b0debc6701c5cf1c839c3319fedc18202ea3ce30160b4588700d933b2Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-24lt-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    63946130-e5ab-476a-98ab-3bb49b7ebd1a
NVD CPE · HARDWAREciscocatalyst_2960-24pc-lEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-2d6b2b31f8174b10d8e6e0ef3cec31ddf0e00f8c9ccdd456f26b12819c10b163Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-24pc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0a9d08ff-dd21-4aae-abb5-561cd80d52af
NVD CPE · HARDWAREciscocatalyst_2960-24pc-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-82220de93b1345bd02a52cafa69257c58a6c2a83bf5375c0e62d6c913ffa86b2Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-24pc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2c594eb3-fecd-4e88-8945-b9cd5ef6ca66
NVD CPE · HARDWAREciscocatalyst_2960-24-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-3a929929acc0ef60025c049e3d28cbf21f47616159b8b6cdf258f2986241afd5Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-24-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    69384d20-0270-4cd5-95d0-7ea93cbde78e
NVD CPE · HARDWAREciscocatalyst_2960-24tc-lEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-9133f0c0a77b6e7e3a0ca31acae5eacc909b8e894fb74831a89f6c81d0bd9fe5Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-24tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    11e79ab1-9c7d-4e72-8038-60b62d3f771b
NVD CPE · HARDWAREciscocatalyst_2960-24tc-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-bb431786a217bcedcae810a2fd7a99720cb65b64bb920fb710244f1e18460444Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-24tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 14
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    784ef30f-54a7-46d8-b9e5-8ca2883563dd
NVD CPE · HARDWAREciscocatalyst_2960-24tt-lEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-77af1641ef65d1c1beeceeb800a077bf632a9386a415b5f708e02c13f28bb651Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-24tt-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 15
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3e6061a1-706d-4129-b99b-318eacb7ab3d
NVD CPE · HARDWAREciscocatalyst_2960-48pst-lEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-b11bcace0875b5668ba48925d6506f4dd7a651d2acebabd299cf453d656c5427Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-48pst-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 16
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0c3ffd5c-1ac5-4d1d-9a66-9167f72e4c6b
NVD CPE · HARDWAREciscocatalyst_2960-48pst-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-1e16d098e5478f97448029a11dc98819878c2c05625c618610371926fce95440Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-48pst-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 17
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    af8e6604-7f57-4147-a4d9-7a37b415d794
NVD CPE · HARDWAREciscocatalyst_2960-48tc-lEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-53a6ab2493450d7ea280459578b98117eb067a381040441d5e1fc12a33e24945Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-48tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 18
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e28218b4-23e0-4319-be93-f09fb552f7d7
NVD CPE · HARDWAREciscocatalyst_2960-48tc-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-e9458dd7dfbbd465e280085373276e1a7f678218f3f80aaac5ff062e1c4469d5Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-48tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 19
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    042a0aa5-fc1b-451e-92a4-1e3c309b0c00
NVD CPE · HARDWAREciscocatalyst_2960-48tt-lEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-f11e9658bdc73f3bac162516572f89a352623d5d2f0416b547752e47d29dbbefLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-48tt-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 20
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d8d63435-4dc4-4597-aade-89bcf470b109
NVD CPE · HARDWAREciscocatalyst_2960-48tt-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-d61b0dde1402523b27ad1d38fb34403f2abeced34cb2cf2ac313e31a12415423Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-48tt-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 21
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    66d51a01-a213-4bb1-84c5-7d29d28a81ca
NVD CPE · HARDWAREciscocatalyst_2960-8tc-lEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-316c4419cf3218f69998ceba521b2456b163aa21d64174e9b97a9d45815aed88Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-8tc-l:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 22
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d562c004-24de-4b9d-a323-c3d2ea32a173
NVD CPE · HARDWAREciscocatalyst_2960-8tc-sEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-9c43ab594605ae8d0e7809ef08c0425baef2192fb0ad02b533d19c1247d3e90cLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:catalyst_2960-8tc-s:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 23
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8d86baf5-681f-4867-a657-d4724f748707

Affected-product evidence

Accepted scope and product mapping

2 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-0774b265c0e837e737aaf99ed0f2450c048e61f34267ca59d8623878b839334e · product-5972f4392170d0d1b4e75a10eb3b383835ead601c8d9b09329525407a4e1471a

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
4cad8494-7129-4c26-8238-717d247520ba
Mapping establishedEvidence supported

vendor-0774b265c0e837e737aaf99ed0f2450c048e61f34267ca59d8623878b839334e · product-cc06181059d0f387414dd5737700c03a38fe93d65d4a541ac9744a37c25c9f59

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
17f919a8-a148-4c82-9927-ed9a0ee22019
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Oct 22, 2026
Retained assertion IDs
38c5c565-df29-4794-9937-85d5f469e79e

Assessments

CVSS by origin

9.8
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10.0
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:L/Au:N/C:C/I:C/A:C
9.8
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Direct CVE/CNA normalized decisions

9.8Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Validation
Valid match
Recomputed
9.8
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.