CVE-2017-12231

CVE-2017-12231 is a denial-of-service flaw in the Network Address Translation (NAT) application layer gateway of Cisco IOS 12.4 through 15.6, caused by improper translation of H.323 Registration, Admission, and Status (RAS) messages. An unauthenticated, remote attacker can exploit it by sending a crafted H.323 RAS packet in IPv4 traffic through an affected device that is performing NAT. A successful attack crashes the device, forcing a reload and interrupting traffic, with no impact on confidentiality or integrity (CVSS 3.1: 7.5 high, availability only). Any Cisco device running affected IOS releases with NAT and the H.323 NAT ALG is exposed, and the ALG is enabled by default, so most NAT-configured IOS devices are potentially affected. The flaw is being actively exploited: it was added to the CISA Known Exploited Vulnerabilities catalog on 2022-03-03, though no public proof-of-concept is known.

What to do: Upgrade affected devices to a fixed Cisco IOS release per Cisco's security advisory (Cisco Bug ID CSCvc57217), as required by the CISA KEV catalog. Where upgrading is not immediately possible, disable the H.323 NAT ALG on affected NAT configurations (per vendor instructions) if H.323/VoIP traffic does not need to traverse that NAT, and prioritize internet-facing or edge routers performing NAT for exposure review. Check device configurations for NAT with the H.323 ALG enabled (default) to identify which devices need remediation.