CVE-2017-12233
Published: 29 September 2017
Summary
CVE-2017-12233 is a high-severity Improper Input Validation (CWE-20) vulnerability in Cisco Ios. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection).
Deeper analysis
The vulnerability CVE-2017-12233 consists of multiple flaws in the Common Industrial Protocol (CIP) implementation within Cisco IOS versions 12.4 through 15.6. These issues arise from improper parsing of CIP packets and are tracked under Cisco Bug ID CSCuz95334 along with CWE-20, carrying a CVSS 3.1 score of 7.5 for high availability impact.
An unauthenticated remote attacker can exploit the weaknesses by sending crafted CIP packets destined to an affected device. Successful exploitation causes the device to reload, producing a denial-of-service condition without requiring authentication or user interaction.
The referenced Cisco Security Advisory cisco-sa-20170927-cip along with associated SecurityFocus and SecurityTracker entries address the reported issues. No information on real-world exploitation or other contextual factors is provided in the source data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-3806
Vulnerability details
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The…
more
vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuz95334.
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of CIP packet inputs to reject malformed data before parsing can trigger a device reload.
Requires mechanisms to protect against crafted CIP packets that produce a denial-of-service reload condition.
Enforces boundary filtering of CIP traffic so that only authorized packets reach the vulnerable IOS parser.