CVE-2017-12235

Deeper analysis

A vulnerability in the PROFINET Discovery and Configuration Protocol (PN-DCP) implementation within Cisco IOS versions 12.2 through 15.6 allows an unauthenticated remote attacker to trigger a device reload and resulting denial of service. The flaw stems from improper parsing of specially crafted ingress PN-DCP Identify Request packets and affects any device configured to process PROFINET messages, with PROFINET enabled by default on base switch module and expansion-unit Ethernet ports beginning in release 12.2(52)SE. The issue is tracked as Cisco Bug ID CSCuz47179 and carries a CVSS 3.1 base score of 7.5 due to its impact on availability.

An attacker can exploit the weakness by sending a single crafted PN-DCP Identify Request packet followed by continued legitimate PN-DCP Identify Request traffic, causing the affected device to reload without requiring authentication or user interaction. Successful exploitation produces only a denial-of-service condition and does not permit arbitrary code execution or information disclosure.

The Cisco Security Advisory cisco-sa-20170927-profinet recommends upgrading to a fixed IOS release or disabling PROFINET processing on affected interfaces where feasible, and provides workarounds such as infrastructure access control lists to limit exposure to trusted PROFINET sources.