Log in Start free

Actively exploited · Published Sep 28, 2017 · Assigned by cisco

CVE-2017-12232

Medium 6.5 Exploited

In plain English

A medium-severity security flaw in Cisco IOS. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)2.2%top 17.8% of all CVEs
Exploited in the wildYesCISA KEV since Mar 3, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 24, 2022.

Official description

A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a misclassification of Ethernet frames. An attacker could exploit this vulnerability by sending a crafted Ethernet frame to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc03809.

Affected products (as reported)

VendorProductVersions
n/a Cisco IOS Cisco IOS

Weakness: CWE-399 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References