Vulnerability Details : CVE-2017-12234
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc43709.
Vulnerability category: Denial of service
Products affected by CVE-2017-12234
- cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
CVE-2017-12234 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2017-12234
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2017-12234
0.35%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 72 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-12234
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST | |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST | 2024-07-16 |
CWE ids for CVE-2017-12234
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2017-12234
-
http://www.securitytracker.com/id/1039459
Cisco IOS Common Industrial Protocol Implementation Bugs Let Remote Users Cause the Target System to Reload - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/101038
Cisco IOS Software Common Industrial Protocol Multiple Denial of Service VulnerabilitiesBroken Link;Third Party Advisory;VDB Entry
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip
Cisco IOS Software Common Industrial Protocol Request Denial of Service VulnerabilitiesVendor Advisory
Jump to