There are no workarounds that address this vulnerability. However, there is a mitigation.
Administrators are advised to allow only trusted users to have SNMP access on an affected system. Administrators are also advised to monitor affected systems by using the show snmp host command in the CLI.
Administrators can disable the affected OIDs on a device. Not all software will support the OID that is listed in the mitigation. If the OID is not valid for specific software, then it is not affected by this vulnerability. Excluding these OIDs may affect device management through SNMP, such as discovery and hardware inventory.
To create or update a view entry and disable the affected OIDs, use the snmp-server view global configuration command, as shown in the following example:
!Standard VIEW and Security Exclusions
snmp-server view NO_BAD_SNMP iso included
snmp-server view NO_BAD_SNMP snmpUsmMIB excluded
snmp-server view NO_BAD_SNMP snmpVacmMIB excluded
snmp-server view NO_BAD_SNMP snmpCommunityMIB excluded
!End Standard View
!Advisory Specific Mappings
!CISCO-AUTH-FRAMEWORK-MIB
snmp-server view NO_BAD_SNMP cafSessionMethodsInfoEntry excluded
To then apply this configuration to a community string, use the following command:
snmp-server community mycomm view NO_BAD_SNMP RO
For SNMPv3, use the following command:
snmp-server group v3group v3 auth read NO_BAD_SNMP write NO_BAD_SNMP
For customers using Meraki cloud-managed switches: If any devices in your dashboard organization are running an affected software release, contact the Meraki support team to apply the recommended mitigation. Using this configuration is recommended until fixed software becomes available.
While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Cisco Security Advisory