CVE-2017-12234

Cisco IOS 12.4 through 15.6 contains flaws in the parsing of Common Industrial Protocol (CIP) packets that allow an unauthenticated, remote attacker to crash an affected device. The improper input handling (CWE-20) is triggered when crafted CIP packets destined to the device are processed by its CIP implementation, requiring no credentials or user interaction. A successful exploit causes the device to reload, so the attacker gains only an availability impact — a denial-of-service condition with no confidentiality or integrity compromise. Any Cisco IOS device on the affected trains that processes CIP traffic, typically in industrial/OT network deployments, is exposed. The vulnerability was added to CISA's Known Exploited Vulnerability catalog on 2022-03-03, confirming exploitation in the wild (ransomware use unknown); no public proof-of-concept is known and EPSS puts the 30-day exploitation probability at 7.1% (94th percentile).

What to do: Upgrade affected devices to a fixed IOS release per Cisco's advisory for Bug ID CSCvc43709 — this is also the CISA KEV required action — and confirm the running software train with 'show version'. Inventory which devices actually process CIP/EtherNet/IP traffic, since only those are exploitable, and in the interim restrict untrusted remote access to them; note that the vendor lists no workaround that fully addresses the flaw.