CVE-2017-12237
published 2017-09-29CVE-2017-12237: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an…
PriorityP276high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-03-24
Exploited in the wild
EPSS
7.13%
93.6th percentile
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. This vulnerability affects Cisco devices that have the Internet Security Association and Key Management Protocol (ISAKMP) enabled. Although only IKEv2 packets can be used to trigger this vulnerability, devices that are running Cisco IOS Software or Cisco IOS XE Software are vulnerable when ISAKMP is enabled. A device does not need to be configured with any IKEv2-specific features to be vulnerable. Many features use IKEv2, including different types of VPNs such as the following: LAN-to-LAN VPN; Remote-access VPN, excluding SSL VPN; Dynamic Multipoint VPN (DMVPN); and FlexVPN. Cisco Bug IDs: CSCvc41277.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ios | 15.0 – 15.6 | — |
| cisco | ios_and_ios_xe | — | — |
| cisco | ios_xe | 3.5.0e – 16.5 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: device must have ISAKMP enabled (not IKEv2-specific config required); exploit uses specific IKEv2 packets sent to the affected device ↗
- →Monitor for sudden high CPU utilization, traceback messages, or unexpected reloads on Cisco IOS/IOS XE devices with ISAKMP enabled — these are observable DoS symptoms of successful exploitation ↗
- →Scope detection to devices running Cisco IOS 15.0–15.6 or Cisco IOS XE 3.5–16.5 with ISAKMP enabled; IKEv2-based VPN features (LAN-to-LAN VPN, Remote-access VPN, DMVPN, FlexVPN) expand the attack surface ↗
- ·A device does NOT need IKEv2-specific configuration to be vulnerable — ISAKMP being enabled is sufficient; any feature using IKEv2 (LAN-to-LAN VPN, Remote-access VPN excluding SSL VPN, DMVPN, FlexVPN) implicitly exposes the attack surface ↗
- ·Cisco confirmed a workaround exists in addition to software updates; refer to the advisory for workaround details before patching ↗
- ·Two Cisco bug IDs are associated with this CVE: CSCvc41277 and CSCvc12306 ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
vulncheck7.5HIGH
cisa7.5HIGH
vendor_cisco8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pcwh-xxqr-qw2j: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15
ghsa_unreviewed·2022-05-13
CVE-2017-12237 [HIGH] CWE-400 GHSA-pcwh-xxqr-qw2j: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. This vulnerability affects Cisco devices that have the Internet Security Association and Key Management Protocol (IS
VulnCheck
Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
vulncheck·2017·CVSS 7.5
CVE-2017-12237 [HIGH] CWE-399 Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.
Affected: Cisco IOS and IOS XE Software
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20170927-ike.html
Remediation Due: 2022-03-24
CISA
Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
cisa·2022-03-03·CVSS 7.5
CVE-2017-12237 [HIGH] CWE-399 Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
Vulnerability: Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
Affected: Cisco IOS and IOS XE Software
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-12237
Remediation Due Date: 2022-03-24
Cisco
Cisco IOS and IOS XE Software Internet Key Exchange Denial of Service Vulnerability
vendor_cisco·2017-09-27·CVSS 8.6
CVE-2017-12237 [HIGH] CWE-399 Cisco IOS and IOS XE Software Internet Key Exchange Denial of Service Vulnerability
Cisco IOS and IOS XE Software Internet Key Exchange Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition.
The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition.
Cisco has released software updates that addre
Cisco
Cisco IOS and IOS XE Software Internet Key Exchange Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-12237 Cisco IOS and IOS XE Software Internet Key Exchange Denial of Service Vulnerability
CVE-2017-12237: Cisco IOS and IOS XE Software Internet Key Exchange Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. Cisco has released software updat
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/101037http://www.securitytracker.com/id/1039460https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ikehttp://www.securityfocus.com/bid/101037http://www.securitytracker.com/id/1039460https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ikehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12237
2017-09-29
Published
2022-03-03
Added to CISA KEV
Exploited in the wild