⚠ Actively exploited
Added to CISA KEV on 2022-03-03. Federal agencies required to patch by 2022-03-24. Required action: Apply updates per vendor instructions..

CVE-2017-12234 — Improper Input Validation in Cisco IOS

CWE-20 — Improper Input Validation6 documents6 sources
Severity
7.5HIGHNVD
EPSS
6.5%
top 8.84%
CISA KEV
KEV
Added 2022-03-03
Due 2022-03-24
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Cisco IOSCisco IOS
Timeline
PublishedSep 29
KEV addedMar 3
KEV dueMar 24
Latest updateMay 13
CISA Required Action: Apply updates per vendor instructions.

Description

Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/ios12.4 — 15.6
▶CVEListV5cisco/cisco_iosCisco IOS

🔴Vulnerability Details

3
GHSA
GHSA-89f3-gxqw-p6pq: Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12↗2022-05-13
▶
CVEList
CVE-2017-12234: Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12↗2017-09-28
▶
VulnCheck
Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability↗2017
▶

📋Vendor Advisories

2
CISA
Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability↗2022-03-03
▶
Cisco
Cisco IOS Software Common Industrial Protocol Request Denial of Service Vulnerabilities↗2017-09-27
▶
CVE-2017-12234 — Improper Input Validation in Cisco IOS | cvebase