Lucene search

CiscoCVE-2017-12237

HistorySep 29, 2017 - 1:34 a.m.

CVE-2017-12237

2017-09-2901:34:48

CWE-399

cisco

web.nvd.nist.gov

878

In Wild

cve-2017-12237

cisco

ios

ikev2

vulnerability

remote attacker

high cpu utilization

denial of service

dos

isakmp

vpn

cisco bug ids

cscvc41277

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.003

Percentile

72.0%

JSON

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. This vulnerability affects Cisco devices that have the Internet Security Association and Key Management Protocol (ISAKMP) enabled. Although only IKEv2 packets can be used to trigger this vulnerability, devices that are running Cisco IOS Software or Cisco IOS XE Software are vulnerable when ISAKMP is enabled. A device does not need to be configured with any IKEv2-specific features to be vulnerable. Many features use IKEv2, including different types of VPNs such as the following: LAN-to-LAN VPN; Remote-access VPN, excluding SSL VPN; Dynamic Multipoint VPN (DMVPN); and FlexVPN. Cisco Bug IDs: CSCvc41277.

Affected configurations

Nvd

Node

ciscoiosRange15.0–15.6

ciscoios_xeRange3.5.0e–16.5

AND

cisco1000_integrated_services_routerMatch-

cisco1100-4g\/6g_integrated_services_routerMatch-

cisco1100-4g_integrated_services_routerMatch-

cisco1100-4gltegb_integrated_services_routerMatch-

cisco1100-4gltena_integrated_services_routerMatch-

cisco1100-4p_integrated_services_routerMatch-

cisco1100-6g_integrated_services_routerMatch-

cisco1100-8p_integrated_services_routerMatch-

cisco1100-lte_integrated_services_routerMatch-

cisco1100_integrated_services_routerMatch-

cisco1101-4p_integrated_services_routerMatch-

cisco1101_integrated_services_routerMatch-

cisco1109-2p_integrated_services_routerMatch-

cisco1109-4p_integrated_services_routerMatch-

cisco1109_integrated_services_routerMatch-

cisco1111x-8p_integrated_services_routerMatch-

cisco1111x_integrated_services_routerMatch-

cisco1120_integrated_services_routerMatch-

cisco1131_integrated_services_routerMatch-

cisco1160_integrated_services_routerMatch-

cisco1240_connected_grid_routerMatch-

cisco1801_integrated_service_routerMatch-

cisco1802_integrated_service_routerMatch-

cisco1803_integrated_service_routerMatch-

cisco1811_integrated_service_routerMatch-

cisco1812_integrated_service_routerMatch-

cisco1841_integrated_service_routerMatch-

cisco1861_integrated_service_routerMatch-

cisco1905_integrated_services_routerMatch-

cisco1906c_integrated_services_routerMatch-

cisco1921_integrated_services_routerMatch-

cisco1941_integrated_services_routerMatch-

cisco1941w_integrated_services_routerMatch-

cisco4000_integrated_services_routerMatch-

cisco422_integrated_services_routerMatch-

cisco4221_integrated_services_routerMatch-

cisco4321\/k9-rf_integrated_services_routerMatch-

cisco4321\/k9-ws_integrated_services_routerMatch-

cisco4321\/k9_integrated_services_routerMatch-

cisco4321_integrated_services_routerMatch-

cisco4331\/k9-rf_integrated_services_routerMatch-

cisco4331\/k9-ws_integrated_services_routerMatch-

cisco4331\/k9_integrated_services_routerMatch-

cisco4331_integrated_services_routerMatch-

cisco4351\/k9-rf_integrated_services_routerMatch-

cisco4351\/k9-ws_integrated_services_routerMatch-

cisco4351\/k9_integrated_services_routerMatch-

cisco4351_integrated_services_routerMatch-

cisco4431_integrated_services_routerMatch-

cisco44461_integrated_services_routerMatch-

cisco4451-x_integrated_services_routerMatch-

cisco4451_integrated_services_routerMatch-

cisco4461_integrated_services_routerMatch-

cisco8101-32fhMatch-

cisco8101-32hMatch-

cisco8102-64hMatch-

cisco8201Match-

cisco8201-32fhMatch-

cisco8202Match-

cisco8208Match-

cisco8212Match-

cisco8218Match-

cisco8800_12-slotMatch-

cisco8800_18-slotMatch-

cisco8800_4-slotMatch-

cisco8800_8-slotMatch-

cisco8804Match-

cisco8808Match-

cisco8812Match-

cisco8818Match-

cisco8831Match-

cisco9800-40Match-

cisco9800-80Match-

cisco9800-clMatch-

cisco9800-lMatch-

ciscoasr_1000Match-

ciscoasr_1000-xMatch-

ciscoasr_1001Match-

ciscoasr_1001-hxMatch-

ciscoasr_1001-hx_rMatch-

ciscoasr_1001-xMatch-

ciscoasr_1001-x_rMatch-

ciscoasr_1002Match-

ciscoasr_1002-hxMatch-

ciscoasr_1002-hx_rMatch-

ciscoasr_1002-xMatch-

ciscoasr_1002-x_rMatch-

ciscoasr_1004Match-

ciscoasr_1006Match-

ciscoasr_1006-xMatch-

ciscoasr_1009-xMatch-

ciscoasr_1013Match-

ciscoasr_1023Match-

ciscocatalyst_3650Match-

ciscocatalyst_3650-12x48fd-eMatch-

ciscocatalyst_3650-12x48fd-lMatch-

ciscocatalyst_3650-12x48fd-sMatch-

ciscocatalyst_3650-12x48uqMatch-

ciscocatalyst_3650-12x48uq-eMatch-

ciscocatalyst_3650-12x48uq-lMatch-

ciscocatalyst_3650-12x48uq-sMatch-

ciscocatalyst_3650-12x48urMatch-

ciscocatalyst_3650-12x48ur-eMatch-

ciscocatalyst_3650-12x48ur-lMatch-

ciscocatalyst_3650-12x48ur-sMatch-

ciscocatalyst_3650-12x48uzMatch-

ciscocatalyst_3650-12x48uz-eMatch-

ciscocatalyst_3650-12x48uz-lMatch-

ciscocatalyst_3650-12x48uz-sMatch-

ciscocatalyst_3650-24pdMatch-

ciscocatalyst_3650-24pd-eMatch-

ciscocatalyst_3650-24pd-lMatch-

ciscocatalyst_3650-24pd-sMatch-

ciscocatalyst_3650-24pdmMatch-

ciscocatalyst_3650-24pdm-eMatch-

ciscocatalyst_3650-24pdm-lMatch-

ciscocatalyst_3650-24pdm-sMatch-

ciscocatalyst_3650-24ps-eMatch-

ciscocatalyst_3650-24ps-lMatch-

ciscocatalyst_3650-24ps-sMatch-

ciscocatalyst_3650-24td-eMatch-

ciscocatalyst_3650-24td-lMatch-

ciscocatalyst_3650-24td-sMatch-

ciscocatalyst_3650-24ts-eMatch-

ciscocatalyst_3650-24ts-lMatch-

ciscocatalyst_3650-24ts-sMatch-

ciscocatalyst_3650-48fd-eMatch-

ciscocatalyst_3650-48fd-lMatch-

ciscocatalyst_3650-48fd-sMatch-

ciscocatalyst_3650-48fqMatch-

ciscocatalyst_3650-48fq-eMatch-

ciscocatalyst_3650-48fq-lMatch-

ciscocatalyst_3650-48fq-sMatch-

ciscocatalyst_3650-48fqmMatch-

ciscocatalyst_3650-48fqm-eMatch-

ciscocatalyst_3650-48fqm-lMatch-

ciscocatalyst_3650-48fqm-sMatch-

ciscocatalyst_3650-48fs-eMatch-

ciscocatalyst_3650-48fs-lMatch-

ciscocatalyst_3650-48fs-sMatch-

ciscocatalyst_3650-48pd-eMatch-

ciscocatalyst_3650-48pd-lMatch-

ciscocatalyst_3650-48pd-sMatch-

ciscocatalyst_3650-48pq-eMatch-

ciscocatalyst_3650-48pq-lMatch-

ciscocatalyst_3650-48pq-sMatch-

ciscocatalyst_3650-48ps-eMatch-

ciscocatalyst_3650-48ps-lMatch-

ciscocatalyst_3650-48ps-sMatch-

ciscocatalyst_3650-48td-eMatch-

ciscocatalyst_3650-48td-lMatch-

ciscocatalyst_3650-48td-sMatch-

ciscocatalyst_3650-48tq-eMatch-

ciscocatalyst_3650-48tq-lMatch-

ciscocatalyst_3650-48tq-sMatch-

ciscocatalyst_3650-48ts-eMatch-

ciscocatalyst_3650-48ts-lMatch-

ciscocatalyst_3650-48ts-sMatch-

ciscocatalyst_3650-8x24pd-eMatch-

ciscocatalyst_3650-8x24pd-lMatch-

ciscocatalyst_3650-8x24pd-sMatch-

ciscocatalyst_3650-8x24uqMatch-

ciscocatalyst_3650-8x24uq-eMatch-

ciscocatalyst_3650-8x24uq-lMatch-

ciscocatalyst_3650-8x24uq-sMatch-

ciscocatalyst_3850Match-

ciscocatalyst_3850-12s-eMatch-

ciscocatalyst_3850-12s-sMatch-

ciscocatalyst_3850-12x48uMatch-

ciscocatalyst_3850-12xs-eMatch-

ciscocatalyst_3850-12xs-sMatch-

ciscocatalyst_3850-16xs-eMatch-

ciscocatalyst_3850-16xs-sMatch-

ciscocatalyst_3850-24p-eMatch-

ciscocatalyst_3850-24p-lMatch-

ciscocatalyst_3850-24p-sMatch-

ciscocatalyst_3850-24pw-sMatch-

ciscocatalyst_3850-24s-eMatch-

ciscocatalyst_3850-24s-sMatch-

ciscocatalyst_3850-24t-eMatch-

ciscocatalyst_3850-24t-lMatch-

ciscocatalyst_3850-24t-sMatch-

ciscocatalyst_3850-24uMatch-

ciscocatalyst_3850-24u-eMatch-

ciscocatalyst_3850-24u-lMatch-

ciscocatalyst_3850-24u-sMatch-

ciscocatalyst_3850-24xsMatch-

ciscocatalyst_3850-24xs-eMatch-

ciscocatalyst_3850-24xs-sMatch-

ciscocatalyst_3850-24xuMatch-

ciscocatalyst_3850-24xu-eMatch-

ciscocatalyst_3850-24xu-lMatch-

ciscocatalyst_3850-24xu-sMatch-

ciscocatalyst_3850-32xs-eMatch-

ciscocatalyst_3850-32xs-sMatch-

ciscocatalyst_3850-48f-eMatch-

ciscocatalyst_3850-48f-lMatch-

ciscocatalyst_3850-48f-sMatch-

ciscocatalyst_3850-48p-eMatch-

ciscocatalyst_3850-48p-lMatch-

ciscocatalyst_3850-48p-sMatch-

ciscocatalyst_3850-48pw-sMatch-

ciscocatalyst_3850-48t-eMatch-

ciscocatalyst_3850-48t-lMatch-

ciscocatalyst_3850-48t-sMatch-

ciscocatalyst_3850-48uMatch-

ciscocatalyst_3850-48u-eMatch-

ciscocatalyst_3850-48u-lMatch-

ciscocatalyst_3850-48u-sMatch-

ciscocatalyst_3850-48xsMatch-

ciscocatalyst_3850-48xs-eMatch-

ciscocatalyst_3850-48xs-f-eMatch-

ciscocatalyst_3850-48xs-f-sMatch-

ciscocatalyst_3850-48xs-sMatch-

ciscocatalyst_3850-nm-2-40gMatch-

ciscocatalyst_3850-nm-8-10gMatch-

ciscocatalyst_8200Match-

ciscocatalyst_8300Match-

ciscocatalyst_8300-1n1s-4t2xMatch-

ciscocatalyst_8300-1n1s-6tMatch-

ciscocatalyst_8300-2n2s-4t2xMatch-

ciscocatalyst_8300-2n2s-6tMatch-

ciscocatalyst_8500Match-

ciscocatalyst_8500-4qcMatch-

ciscocatalyst_8500lMatch-

ciscocatalyst_8510csrMatch-

ciscocatalyst_8510msrMatch-

ciscocatalyst_8540csrMatch-

ciscocatalyst_8540msrMatch-

ciscocatalyst_9200Match-

ciscocatalyst_9200cxMatch-

ciscocatalyst_9200lMatch-

ciscocatalyst_9300Match-

ciscocatalyst_9300-24p-aMatch-

ciscocatalyst_9300-24p-eMatch-

ciscocatalyst_9300-24s-aMatch-

ciscocatalyst_9300-24s-eMatch-

ciscocatalyst_9300-24t-aMatch-

ciscocatalyst_9300-24t-eMatch-

ciscocatalyst_9300-24u-aMatch-

ciscocatalyst_9300-24u-eMatch-

ciscocatalyst_9300-24ux-aMatch-

ciscocatalyst_9300-24ux-eMatch-

ciscocatalyst_9300-48p-aMatch-

ciscocatalyst_9300-48p-eMatch-

ciscocatalyst_9300-48s-aMatch-

ciscocatalyst_9300-48s-eMatch-

ciscocatalyst_9300-48t-aMatch-

ciscocatalyst_9300-48t-eMatch-

ciscocatalyst_9300-48u-aMatch-

ciscocatalyst_9300-48u-eMatch-

ciscocatalyst_9300-48un-aMatch-

ciscocatalyst_9300-48un-eMatch-

ciscocatalyst_9300-48uxm-aMatch-

ciscocatalyst_9300-48uxm-eMatch-

ciscocatalyst_9300lMatch-

ciscocatalyst_9300l-24p-4g-aMatch-

ciscocatalyst_9300l-24p-4g-eMatch-

ciscocatalyst_9300l-24p-4x-aMatch-

ciscocatalyst_9300l-24p-4x-eMatch-

ciscocatalyst_9300l-24t-4g-aMatch-

ciscocatalyst_9300l-24t-4g-eMatch-

ciscocatalyst_9300l-24t-4x-aMatch-

ciscocatalyst_9300l-24t-4x-eMatch-

ciscocatalyst_9300l-48p-4g-aMatch-

ciscocatalyst_9300l-48p-4g-eMatch-

ciscocatalyst_9300l-48p-4x-aMatch-

ciscocatalyst_9300l-48p-4x-eMatch-

ciscocatalyst_9300l-48t-4g-aMatch-

ciscocatalyst_9300l-48t-4g-eMatch-

ciscocatalyst_9300l-48t-4x-aMatch-

ciscocatalyst_9300l-48t-4x-eMatch-

ciscocatalyst_9300l_stackMatch-

ciscocatalyst_9300lmMatch-

ciscocatalyst_9300xMatch-

ciscocatalyst_9400Match-

ciscocatalyst_9400_supervisor_engine-1Match-

ciscocatalyst_9407rMatch-

ciscocatalyst_9410rMatch-

ciscocatalyst_9500Match-

ciscocatalyst_9500hMatch-

ciscocatalyst_9600Match-

ciscocatalyst_9600_supervisor_engine-1Match-

ciscocatalyst_9600xMatch-

ciscocatalyst_9800Match-

ciscocatalyst_9800-clMatch-

ciscocatalyst_9800-lMatch-

ciscocatalyst_9800-l-cMatch-

ciscocatalyst_9800-l-fMatch-

ciscocatalyst_ie3200_rugged_switchMatch-

ciscocatalyst_ie3300_rugged_switchMatch-

ciscocatalyst_ie3400_heavy_duty_switchMatch-

ciscocatalyst_ie3400_rugged_switchMatch-

ciscocatalyst_ie9300Match-

ciscocbr-8_converged_broadband_routerMatch-

ciscoesr-6300-con-k9Match-

ciscoesr-6300-ncp-k9Match-

ciscoesr6300Match-

ciscointegrated_services_virtual_routerMatch-

VendorProductVersionCPE
ciscoios*cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
ciscoios_xe*cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
cisco1000_integrated_services_router-cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-4g\/6g_integrated_services_router-cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-4g_integrated_services_router-cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-4gltegb_integrated_services_router-cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-4gltena_integrated_services_router-cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-4p_integrated_services_router-cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-6g_integrated_services_router-cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*
cisco1100-8p_integrated_services_router-cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios	*	cpe:2.3:o:cisco:ios::::::::
cisco	ios_xe	*	cpe:2.3:o:cisco:ios_xe::::::::
cisco	1000_integrated_services_router	-	cpe:2.3:h:cisco:1000_integrated_services_router:-:::::::*
cisco	1100-4g\/6g_integrated_services_router	-	cpe:2.3:h:cisco:1100-4g\/6g_integrated_services_router:-:::::::*
cisco	1100-4g_integrated_services_router	-	cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:::::::*
cisco	1100-4gltegb_integrated_services_router	-	cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:::::::*
cisco	1100-4gltena_integrated_services_router	-	cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:::::::*
cisco	1100-4p_integrated_services_router	-	cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:::::::*
cisco	1100-6g_integrated_services_router	-	cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:::::::*
cisco	1100-8p_integrated_services_router	-	cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:::::::*

Rows per page:

1-10 of 3011

CNA Affected

[
  {
    "product": "Cisco IOS and IOS XE",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco IOS and IOS XE"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101037

www.securitytracker.com/id/1039460

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ike

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.003

Percentile

72.0%

JSON

Related for CVE-2017-12237