9.8 Critique Exploitée

CVE-2017-12240 Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability

Exploitation active constatée

· catalogue CISA KEV

Action attendue Apply updates per vendor instructions.

Campagnes de rançongiciel Non constatée à ce jour

Faiblesse CWE-20

Description

The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Cisco IOS and IOS XE	Versions non publiées

Références

quickview.cloudapps.cisco.com quickview.cloudapps.cisco.com
quickview.cloudapps.cisco.com quickview.cloudapps.cisco.com
101034 www.securityfocus.com
tools.cisco.com tools.cisco.com
1039445 www.securitytracker.com

Chronologie

Publiée 28 septembre 2017
Ajoutée au catalogue KEV 3 mars 2022
Dernière modification 12 janvier 2026

Les 25 CVE de Cisco IOS and IOS XE →

CVE-2018-0172 Cisco IOS and IOS XE Software Improper Input Validation Vulnerability 8.6 Élevée CVE-2018-0174 Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability 8.6 Élevée CVE-2018-0173 Cisco IOS and IOS XE Software Improper Input Validation Vulnerability 8.6 Élevée CVE-2018-0155 Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability 8.6 Élevée

Suivre cette CVE