Read the docs
TI-2017-04534 Aliases CVE-2017-6780GHSA-858q-mfhq-6h9q

Resource management flaw in Cisco IoT Field Network Director

Priority LOW 36CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart, aka Memory Exhaustion. The vulnerability is due to insufficient rate-limiting protection. An attacker could exploit this vulnerability by sending a high rate of TCP packets to a specific group of open listening ports on a targeted device. An exploit could allow the attacker to cause the system to consume additional memory. If enough available memory is consumed, the system will restart, creating a temporary denial of service (DoS) condition. The DoS condition will end after the device has finished the restart process. This vulnerability affects the following Cisco products: Connected Grid Network Management System, if running a software release prior to IoT-FND Release 4.0; IoT Field Network Director, if running a software release prior to IoT-FND Release 4.0. Cisco Bug IDs: CSCvc77164.

Why it matters now

EPSS 0.01738 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco IoT Field Network DirectorCisco IoT Field Network Director—No fix listedCNA
  • Cisco IoT Field Network Director Vendor— Affected Cisco IoT Field Network Director Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:cisco:connected_grid_network_management_system:*:*:*:*:*:*:*:*up to 3.0\(0.54\)VulnerableCisco
cpe:2.3:a:cisco:iot_field_network_director:*:*:*:*:*:*:*:*up to 3.2.0-182VulnerableCisco
  • cpe:2.3:a:cisco:connected_grid_network_management_system:*:*:*:*:*:*:*:* Versions up to 3.0\(0.54\) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:iot_field_network_director:*:*:*:*:*:*:*:* Versions up to 3.2.0-182 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-6780
  2. 2026-10-03 Alias added: GHSA-858q-mfhq-6h9q

References

Advisory 1

  • TI-2013-01010 Multiple SQL injection vulnerabilities in the device-management implementation in Cisco… CVSS 2.0HIGH 7.5
  • TI-2015-05346 The web GUI in Cisco Connected Grid Network Management System (CG-NMS) 3.0(0.35) and… CVSS 2.0MEDIUM 4.0
  • TI-2013-01018 Multiple cross-site scripting (XSS) vulnerabilities in the element-list implementation in… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences