Cisco · IOS XE Software
CVE-2017-12319
Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability
Cos'è
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. An attacker could exploit this vulnerability by sending a crafted BGP packet to an affected device after the BGP session was established. An exploit could allow the attacker to cause the affected device to reload or corrupt the BGP routing table; either outcome would result in a DoS. The vulnerability may be triggered when the router receives a crafted BGP message from a peer on an existing BGP session. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations. If the device is not configured for EVPN, it is not vulnerable. Cisco Bug IDs: CSCui67191, CSCvg52875.
CISA: A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 24 marzo 2022
Altre falle sfruttate di Cisco
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 3 mar 2022 | IOS Software and Cisco IOS XE Software Improper Input Validation | IOS XE Software | Alta 8,6 | 7,6% |
| 14 ott 2026 | Relative Path Traversal | Secure Email Gateway | Critica 9,8 | 2,2% |
| 30 set 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critica 9,8 | 39% |
| 16 set 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critica 10,0 | 76% |
| 14 set 2026 | SQL Injection | Secure Email Gateway | Critica 9,8 | 30% |
| 9 set 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Critica 10,0 | 88% |
| 11 ago 2026 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Alta 8,6 | 1,0% |
| 29 lug 2026 | Secure Firewall Management Center Use of Hard-coded Password | Secure Firewall Management Center (FMC) | Media 5,3 | 35% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.