CVE-2017-12234
Published: 29 September 2017
Summary
CVE-2017-12234 is a high-severity Improper Input Validation (CWE-20) vulnerability in Cisco Ios. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
The vulnerability tracked as CVE-2017-12234 consists of multiple flaws in the Common Industrial Protocol (CIP) implementation within Cisco IOS versions 12.4 through 15.6. These issues stem from improper parsing of specially crafted CIP packets and are identified under Cisco Bug ID CSCvc43709, carrying a CVSS v3 score of 7.5 that reflects a high availability impact with no confidentiality or integrity effects.
An unauthenticated remote attacker can exploit the weaknesses by sending crafted CIP packets to an affected device. Successful exploitation results in a device reload and denial-of-service condition, with the attack vector requiring no user interaction or privileges and being remotely reachable over the network.
The Cisco Security Advisory cisco-sa-20170927-cip, along with related tracking entries at SecurityFocus and SecurityTracker, addresses mitigation steps and software updates for the affected IOS releases. No public information on in-the-wild exploitation is supplied in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-3807
Vulnerability details
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The…
more
vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc43709.
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires mechanisms to protect against or limit the effects of DoS attacks from crafted network packets such as the malicious CIP packets in this CVE.
Requires validation and sanitization of all inputs, directly mitigating the root cause of improper CIP packet parsing that leads to device reload.
Enforces boundary controls and traffic filtering that can block or rate-limit unauthenticated CIP packets before they reach the vulnerable IOS parser.