CVE-2017-12319

CVE-2017-12319 is an input-validation flaw (CWE-20) in Cisco IOS XE Software's implementation of BGP over Ethernet VPN (EVPN), arising from implementation changes across IOS XE releases of the RFC 7432 draft, where the IP address length field can be miscalculated when processing BGP Inclusive Multicast Ethernet Tag Route or MAC/IP Advertisement Route updates. An unauthenticated remote attacker who can send a crafted BGP message over an established BGP session (i.e., a BGP peer or someone able to inject into one) can cause the device to reload or corrupt the BGP routing table, producing a denial of service or broader network instability. Only IOS XE releases prior to 16.3 that are configured for BGP EVPN are affected; devices without an EVPN configuration are not vulnerable. Cisco added the issue to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03 (indicating observed in-the-wild exploitation), EPSS assigns a roughly 5% probability of exploitation in the next 30 days, and no public proof-of-concept is known.

What to do: Upgrade affected devices to Cisco IOS XE release 16.3 or later per vendor instructions (tracked under Cisco bug IDs CSCui67191 and CSCvg52875). Until upgrading, restrict which peers can establish BGP sessions to the device (peering access lists or control-plane policies) or remove EVPN configuration if it is not required. Inventory IOS XE devices running releases before 16.3 and check for EVPN configuration (e.g., 'show running-config | section evpn') to identify vulnerable routers.