Product:
Cisco IOS
Summary
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization or a reload of an affected device, leading to a denial of service (DoS) condition. This vulnerability is due to how an affected device processes certain IKEv2 packets. Devices with ISAKMP enabled are vulnerable, regardless of specific IKEv2 configurations.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2017-12237 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted IKEv2 packets to an affected device. The device processes these packets in a way that can lead to high CPU utilization or a reload, resulting in a denial of service. The attack does not require any authentication, making it easier for attackers to target vulnerable devices.
Affected Products
- Cisco IOS 15.0 through 15.6
- Cisco IOS XE 3.5 through 16.5
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Ensuring that ISAKMP is disabled on devices that do not require it can also help reduce the risk of exploitation.