Lucene search

CiscoCVE-2017-12235

HistorySep 29, 2017 - 1:34 a.m.

CVE-2017-12235

2017-09-2901:34:48

CWE-20

cisco

web.nvd.nist.gov

833

In Wild

vulnerability

profinet

pn-dcp

cisco

ios

remote attacker

dos

reload

nvd

cve-2017-12235

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

72.0%

JSON

A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper parsing of ingress PN-DCP Identify Request packets destined to an affected device. An attacker could exploit this vulnerability by sending a crafted PN-DCP Identify Request packet to an affected device and then continuing to send normal PN-DCP Identify Request packets to the device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to process PROFINET messages. Beginning with Cisco IOS Software Release 12.2(52)SE, PROFINET is enabled by default on all the base switch module and expansion-unit Ethernet ports. Cisco Bug IDs: CSCuz47179.

Affected configurations

Nvd

Node

ciscoiosRange12.2–15.6

AND

ciscoindustrial_ethernet_2000_16ptc-g-e_switchMatch-

ciscoindustrial_ethernet_2000_16ptc-g-l_switchMatch-

ciscoindustrial_ethernet_2000_16ptc-g-nx_switchMatch-

ciscoindustrial_ethernet_2000_16t67-b_switchMatch-

ciscoindustrial_ethernet_2000_16t67p-g-e_switchMatch-

ciscoindustrial_ethernet_2000_16tc-g-e_switchMatch-

ciscoindustrial_ethernet_2000_16tc-g-l_switchMatch-

ciscoindustrial_ethernet_2000_16tc-g-n_switchMatch-

ciscoindustrial_ethernet_2000_16tc-g-x_switchMatch-

ciscoindustrial_ethernet_2000_16tc-l_switchMatch-

ciscoindustrial_ethernet_2000_24t67-b_switchMatch-

ciscoindustrial_ethernet_2000_4s-ts-g-b_switchMatch-

ciscoindustrial_ethernet_2000_4s-ts-g-l_switchMatch-

ciscoindustrial_ethernet_2000_4t-b_switchMatch-

ciscoindustrial_ethernet_2000_4t-g-b_switchMatch-

ciscoindustrial_ethernet_2000_4t-g-l_switchMatch-

ciscoindustrial_ethernet_2000_4t-l_switchMatch-

ciscoindustrial_ethernet_2000_4ts-b_switchMatch-

ciscoindustrial_ethernet_2000_4ts-g-b_switchMatch-

ciscoindustrial_ethernet_2000_4ts-g-l_switchMatch-

ciscoindustrial_ethernet_2000_4ts-l_switchMatch-

ciscoindustrial_ethernet_2000_8t67-b_switchMatch-

ciscoindustrial_ethernet_2000_8t67p-g-e_switchMatch-

ciscoindustrial_ethernet_2000_8tc-b_switchMatch-

ciscoindustrial_ethernet_2000_8tc-g-b_switchMatch-

ciscoindustrial_ethernet_2000_8tc-g-e_switchMatch-

ciscoindustrial_ethernet_2000_8tc-g-l_switchMatch-

ciscoindustrial_ethernet_2000_8tc-g-n_switchMatch-

ciscoindustrial_ethernet_2000_8tc-l_switchMatch-

ciscoindustrial_ethernet_2000_series_firmwareMatch15.2\(5.4.32i\)e2

VendorProductVersionCPE
ciscoios*cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16ptc-g-e_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-e_switch:-:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16ptc-g-l_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-l_switch:-:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16ptc-g-nx_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-nx_switch:-:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16t67-b_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16t67-b_switch:-:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16t67p-g-e_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16t67p-g-e_switch:-:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16tc-g-e_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-e_switch:-:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16tc-g-l_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-l_switch:-:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16tc-g-n_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-n_switch:-:*:*:*:*:*:*:*
ciscoindustrial_ethernet_2000_16tc-g-x_switch-cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-x_switch:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios	*	cpe:2.3:o:cisco:ios::::::::
cisco	industrial_ethernet_2000_16ptc-g-e_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-e_switch:-:::::::*
cisco	industrial_ethernet_2000_16ptc-g-l_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-l_switch:-:::::::*
cisco	industrial_ethernet_2000_16ptc-g-nx_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16ptc-g-nx_switch:-:::::::*
cisco	industrial_ethernet_2000_16t67-b_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16t67-b_switch:-:::::::*
cisco	industrial_ethernet_2000_16t67p-g-e_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16t67p-g-e_switch:-:::::::*
cisco	industrial_ethernet_2000_16tc-g-e_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-e_switch:-:::::::*
cisco	industrial_ethernet_2000_16tc-g-l_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-l_switch:-:::::::*
cisco	industrial_ethernet_2000_16tc-g-n_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-n_switch:-:::::::*
cisco	industrial_ethernet_2000_16tc-g-x_switch	-	cpe:2.3:h:cisco:industrial_ethernet_2000_16tc-g-x_switch:-:::::::*

Rows per page:

1-10 of 311

CNA Affected

[
  {
    "product": "Cisco IOS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco IOS"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101043

www.securitytracker.com/id/1039451

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-profinet

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

72.0%

JSON

Related for CVE-2017-12235