CVE-2017-12240

CVE-2017-12240 is a buffer overflow (CWE-119/CWE-20) in the DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software. An unauthenticated, remote attacker can trigger it by sending a crafted DHCPv4 packet to a device running affected software with the DHCP relay subsystem processing untrusted packets. Successful exploitation allows arbitrary code execution and full control of the system, or alternatively forces a reload that causes a denial of service. Any organization running affected Cisco IOS or IOS XE releases on routers or Layer 3 switches, particularly edge or relay devices reachable over the network, is potentially affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, indicating active exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed; EPSS assigns a 13.9% probability of exploitation within 30 days (96th percentile).

What to do: Apply the fixed software releases per Cisco's advisory and CISA's required action (apply vendor updates), prioritizing internet-facing routers and devices with DHCP relay configured. As interim mitigation, disable DHCP relay where it is not needed and restrict access to DHCP ports (UDP 67/68) on affected devices using ACLs or upstream firewall rules. Check device inventory for IOS releases in the 12.2–15.6 range and IOS XE releases listed in the advisory, and verify whether DHCP relay is in use on each.