Skip to content
COOEY

EXPOSURES › CVE-2017-12319

CVE-2017-12319

HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2022-03-03 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2017-12319 ↗
⌖ EXPLOITED IN THE WILD SHAME 65/100 exploited-in-wildunpatched

Cisco IOS XE EVPN BGP vulnerability allows remote unauthenticated attackers to cause device reboots or corrupt routing tables, leading to network instability.

This DoS vulnerability in Cisco IOS XE EVPN BGP lets remote attackers force device reboots or corrupt routing tables, causing network instability. DIB orgs must ensure all network infrastructure is patched against actively exploited KEV vulnerabilities to prevent operational outages and maintain compliance with NIST 800-171 security requirements. Failure to patch known vulnerabilities exposes the organization to unavailability and potential data loss during critical operations.

Shame score — Cisco failed to patch a known BGP vulnerability that was actively exploited in the wild, causing network instability and demonstrating negligence in maintaining secure network infrastructure.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

DESCRIPTION

A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.

AFFECTED FEDRAMP PRODUCTS · 9
PRODUCTSTATUS
AppDynamics GovAPM
AppDynamics (a Cisco company)
Authorized
Cisco Cloudlock for Government
Cisco Systems Inc.
Authorized
Cisco Meraki for Government
Cisco Systems Inc.
In Process
Cisco SD-WAN for Government
Cisco Systems Inc.
In Process
Cisco Umbrella for Government
Cisco Systems Inc.
In Process
Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government)
Cisco Systems Inc.
Authorized
Duo Federal
Duo Security (A Cisco Company)
Authorized
WebEx Contact Center Enterprise for Government (WxCCE-G)
Cisco Systems Inc.
In Process
Webex for Government
Cisco Systems Inc.
Authorized