CVE-2017-12233

Cisco IOS versions 12.4 through 15.6 contain multiple flaws in their implementation of the Common Industrial Protocol (CIP) that allow an unauthenticated, remote attacker to crash an affected device (Cisco bug CSCuz95334). The flaws stem from improper parsing of crafted CIP packets destined to the device, so exploitation only requires the attacker to be able to send malicious CIP traffic to it, with no credentials or user interaction needed. A successful exploit forces the device to reload, resulting in a denial of service; per the CVSS scoring there is no impact on confidentiality or integrity. Any organization running Cisco IOS 12.4-15.6 on devices reachable by untrusted CIP (EtherNet/IP) traffic is affected, spanning enterprise edge and industrial network deployments. The issue was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, confirming in-the-wild exploitation, though no public proof-of-concept is known and any ransomware association is unknown.

What to do: Inventory devices running IOS 12.4-15.6, prioritize internet-facing ones, and upgrade to a fixed release per Cisco's advisory for bug CSCuz95334, in line with CISA's KEV required action (federal agencies must patch). As an interim mitigation, use ACLs or firewall rules to prevent untrusted hosts from sending CIP/EtherNet/IP traffic (typically TCP/UDP 44818 and UDP 2222) directly to the device. Watch for unexpected device reloads as an indicator of exploitation.