How severe is CVE-2017-12233?

CVE-2017-12233 has a CVSS 3.1 base score of 7.5 (HIGH). EPSS estimates a 7.1% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2017-12233: Cisco IOS Software Common Industrial Protocol Request

CISA Known Exploited Vulnerabilities

Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-03-03

Remediation due

2022-03-24

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2017-12233

Description

Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuz95334.

Severity

CVSS 3.1 · CISA7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impactpartial

Affected Products

Vendor	Product	Affected versions
-	Cisco IOS	Cisco IOS

References

3 Links

Vulnerability databases

Other references

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip

Record Details

Published

2017-09-28

Last updated

2026-01-12

Assigner (CNA)

cisco

Credited to

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-20 · Improper Input Validation

Application Security Tools Fuzzing

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.