EXPOSURES › CVE-2017-12234
CVE-2017-12234
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco IOS CIP vulnerability allows remote denial-of-service via unauthenticated requests causing device reloads.
An unauthenticated remote attacker can trigger a denial-of-service by causing affected Cisco IOS devices to reload via the Common Industrial Protocol (CIP) feature. This impacts DIB organizations relying on industrial network equipment, as unpatched devices remain vulnerable to exploitation in the wild. Organizations must ensure CIP features are disabled or patched to prevent availability disruptions.
Shame score — A known, actively exploited vulnerability in industrial protocol handling that causes device reloads, representing a moderate embarrassment due to its KEV status and industrial impact.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
"There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service."
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |