Actively exploited in the wild
Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability
Cisco - Catalyst 6800 Series Switches · Listed in the CISA KEV since 2022-03-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2017-12238
MediumCVSS 6.5KEVSummary
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches allows an unauthenticated, adjacent attacker to crash a C6800-16P10G or C6800-16P10G-XL line card, causing a denial of service (DoS). It stems from a memory management issue; the attacker creates a large number of VPLS-generated MAC entries in the MAC address table.
Risk Assessment
Organizations using Cisco Catalyst 6800 Series Switches with C6800-16P10G/C6800-16P10G-XL line cards, Supervisor Engine 6T, and VPLS configured may experience line card crashes and network outages.
Recommendation
Upgrade Cisco IOS to a release containing the fix for CSCva61927 or apply Cisco-recommended workarounds (e.g., restricting VPLS on affected interfaces).
Other vulnerabilities in Cisco IOS
See all- CVE-2016-1478High
Cisco IOS versions 15.5(3)S3, 15.6(1)S2, 15.6(2)S1, and 15.6(2)T1 improperly dequeue invalid NTP packets, allowing remote attackers to cause a denial of service (interface wedge) by sending many crafted NTP packets.
- CVE-2015-0649High
Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3 allow remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets.
- CVE-2015-0647High
Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3 allow remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets.
- CVE-2015-0638High
In Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3, configuring a VRF interface allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets.
- CVE-2017-12232MediumActively exploited
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 allows an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS). It is due to misclassification of Ethernet frames; the attacker sends a crafted Ethernet frame.
- CVE-2008-4128MediumActively exploited
Multiple CSRF vulnerabilities in the HTTP Administration component of Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands. The attack involves requests to the /level/15/exec/- URI with the "show privilege" command and to the /level/15/exec/-/configure/http URI with the "alias exec" command.
- CVE-2004-1464MediumActively exploited
Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.
- CVE-1999-0063Medium
Cisco IOS 12.0 and other versions can be crashed by malicious UDP packets to the syslog port.
- CVE-1999-0445Medium
In some versions of IOS 12.0 on Cisco routers running NAT, some packets may not be filtered by input access list filters.
- CVE-1999-0162Medium
The 'established' keyword in some Cisco IOS software allowed an attacker to bypass filtering.
Original NVD description (English source)
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service (DoS) condition. The vulnerability is due to a memory management issue in the affected software. An attacker could exploit this vulnerability by creating a large number of VPLS-generated MAC entries in the MAC address table of an affected device. A successful exploit could allow the attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a DoS condition. This vulnerability affects Cisco Catalyst 6800 Series Switches that are running a vulnerable release of Cisco IOS Software and have a Cisco C6800-16P10G or C6800-16P10G-XL line card in use with Supervisor Engine 6T. To be vulnerable, the device must also be configured with VPLS and the C6800-16P10G or C6800-16P10G-XL line card needs to be the core-facing MPLS interfaces. Cisco Bug IDs: CSCva61927.