CVE-2017-12232

Cisco IOS versions 15.0 through 15.6 running on Integrated Services Routers Generation 2 (ISR G2) routers contain a denial-of-service flaw caused by the misclassification of certain Ethernet frames. An unauthenticated attacker positioned adjacent to the device on the same Layer 2 segment can send a specially crafted Ethernet frame to the router, triggering a device reload. The attacker gains no data access - confidentiality and integrity are unaffected - but the forced reload halts routing at the site, producing an availability-only denial of service. Any organization operating ISR G2 routers on IOS 15.0-15.6 is affected, with risk concentrated on interfaces reachable from untrusted adjacent networks such as LAN, WAN-facing, or guest segments. The vulnerability is listed in CISA KEV (added 2022-03-03), indicating known exploitation in the wild; ransomware association is unknown, no public PoC is known, and EPSS puts the 30-day exploitation probability at 2.2% (81st percentile).

What to do: Per the CISA KEV required action, upgrade affected ISR G2 routers to a fixed Cisco IOS release in the 15.0-15.6 train per Cisco's advisory (bug ID CSCvc03809), confirming current versions with 'show version'. Where upgrades are delayed - many ISR G2 units are past standard software maintenance - limit untrusted devices' access to the Layer 2 segments attached to the router's interfaces and monitor syslog and crashinfo files for unexpected reloads. Treat any unexplained router reload on affected IOS versions as a possible exploitation indicator.