Cloudanix VulnDB

CVE-2017-12319

Medium · 5.9 CISA KEV

CVSS

5.9

EPSS

5.2%

Published

Mar 27, 2018

CISA due date

Mar 24, 2022

Cloudanix analysis

Act now SSVC: Attend

Certain older Cisco network devices can be forced to crash or lose their routing information when they receive a specially crafted message from a trusted network partner, potentially knocking parts of the network offline.

Active In The Wild
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Miscalculation of the IP address length field in BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packets causes device reload or corruption of the BGP routing table on affected Cisco IOS XE releases prior to 16.3 when EVPN is configured.

Why it matters to the business

Organizations relying on Cisco IOS XE devices with BGP EVPN face sudden network outages, routing instability, and potential prolonged downtime; the issue was added to CISA KEV with a 2022-03-24 remediation deadline and remains actively exploited in the wild.

How an attack unfolds

An attacker first establishes a legitimate BGP session with a vulnerable device, then transmits a single crafted BGP EVPN packet that triggers the length-field miscalculation, resulting in immediate reload or routing-table corruption.

How to fix it

Upgrade all affected Cisco IOS XE installations that use BGP EVPN to release 16.3 or later; disable EVPN configuration on devices that cannot be upgraded immediately; monitor Cisco advisory CSCui67191 and CSCvg52875 for additional fixed images.

How to confirm the fix worked

Verify running IOS XE version is 16.3 or higher; confirm absence of BGP EVPN configuration on any remaining older releases; attempt to reproduce the crash condition in a lab environment using the published packet structure after applying the fix.

Typical attack path

  1. Identify exposed Cisco IOS XE devices advertising BGP EVPN support
  2. Establish a BGP peering session with the target
  3. Send a single malformed BGP Inclusive Multicast Ethernet Tag Route or MAC/IP Advertisement packet
  4. Trigger device reload or routing-table corruption leading to DoS

How to detect it

Review BGP session logs and device crash dumps for entries referencing BGP EVPN route updates or the CSCui67191 / CSCvg52875 bug IDs; correlate unexpected reloads with inbound BGP traffic from established peers; examine historical KEV exploitation timelines for post-2018 activity indicators.

What your security team should do

  • Immediately inventory all Cisco IOS XE devices and identify those running BGP EVPN on releases earlier than 16.3
  • Prioritize patching of internet-facing or critical backbone routers given KEV listing and active exploitation
  • Apply the upgrade to 16.3+ or disable EVPN where feasible within 48 hours for high-value assets
  • Enable BGP session logging and monitor for unexpected reloads correlated with BGP EVPN traffic

The record

A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. An attacker could exploit this vulnerability by sending a crafted BGP packet to an affected device after the BGP session was established. An exploit could allow the attacker to cause the affected device to reload or corrupt the BGP routing table; either outcome would result in a DoS. The vulnerability may be triggered when the router receives a crafted BGP message from a peer on an existing BGP session. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations. If the device is not configured for EVPN, it is not vulnerable. Cisco Bug IDs: CSCui67191, CSCvg52875.

Affected packages

Ecosystem Package Introduced Fixed