Product:
Cisco IOS
Summary
Multiple vulnerabilities in the implementation of the Common Industrial Protocol feature in Cisco IOS versions 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service condition. These vulnerabilities arise from improper parsing of crafted CIP packets. A successful exploit could lead to a complete denial of service.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2017-12234 |
Exploitation
An attacker can exploit these vulnerabilities by sending specially crafted CIP packets to an affected device. The improper handling of these packets by the device can trigger a reload, leading to a denial of service. Since no authentication is required, the attack can be executed remotely, making it easier for attackers to target vulnerable devices.
Affected Products
- Cisco IOS 12.4 – Vulnerable to denial of service due to improper parsing of CIP packets.
- Cisco IOS 15.6 – Similar vulnerabilities allowing remote attackers to cause device reloads.
Mitigation
To mitigate these vulnerabilities, it is recommended to apply updates as per the vendor’s instructions. Keeping the software up to date will help protect against potential exploits targeting these vulnerabilities.