Vulnerabilities ›

CVE-2017-12319

Critical 🇺🇸 CISA KEV ⚡ Exploit Available

                    Published: Mar 3, 2022                                          ·  Source: CISA_KEV                

CVSS v3

9.0

🔗 NVD Official

📄 Description (English)

Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability — A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.

🤖 AI Executive Summary

CVE-2017-12319 is a critical vulnerability in Cisco IOS XE Software affecting BGP over EVPN that allows an unauthenticated remote attacker to cause device reload (DoS) or corrupt BGP routing tables, leading to network instability. With a CVSS score of 9.0 and known exploits available, this vulnerability poses severe risk to network infrastructure. The ability to disrupt BGP routing can cause cascading failures across interconnected networks. A patch is available from Cisco and should be applied immediately.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Apr 8, 2026 00:37

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability critically impacts Saudi telecom providers (STC, Mobily, Zain) and ISPs that rely heavily on Cisco IOS XE routers for BGP peering and EVPN deployments. Saudi government networks managed by NCA, ARAMCO's extensive enterprise network, and SAMA-regulated banking institutions using Cisco backbone infrastructure are at high risk. Disruption of BGP routing could affect national internet connectivity, data center interconnections, and critical infrastructure communications across the Kingdom. Energy sector SCADA network backbones and smart city initiatives (NEOM, Riyadh) using EVPN fabrics are particularly exposed.

🏢 Affected Saudi Sectors

Telecommunications Government Banking Energy Healthcare Defense

⚖️ Saudi Risk Score (AI)

8.5

/ 10.0

🔧 Remediation Steps (English)

1. IMMEDIATE ACTIONS:

- Identify all Cisco IOS XE devices running BGP with EVPN configurations using 'show bgp l2vpn evpn summary'

- Apply Cisco security advisory patches immediately (cisco-sa-20171004-evpn)

- Monitor BGP sessions for unexpected resets or routing table anomalies



2. PATCHING GUIDANCE:

- Upgrade Cisco IOS XE to the fixed software versions specified in Cisco's advisory

- Schedule emergency maintenance windows for critical routing infrastructure

- Test patches in lab environment before production deployment



3. COMPENSATING CONTROLS:

- Implement BGP TTL Security Hack (GTSM) to limit BGP session establishment to directly connected peers

- Configure BGP maximum-prefix limits to detect routing table corruption

- Enable BGP route dampening and implement prefix filtering

- Use control plane policing (CoPP) to rate-limit BGP traffic

- Implement BGP peer authentication using MD5 or TCP-AO



4. DETECTION RULES:

- Monitor for unexpected BGP session flaps via SNMP traps and syslog

- Alert on device reloads correlated with BGP EVPN activity

- Implement NetFlow/IPFIX monitoring for anomalous BGP traffic patterns

- Create IDS/IPS signatures for malformed BGP EVPN UPDATE messages

🔧 خطوات المعالجة (العربية)

1. إجراءات فورية:

- تحديد جميع أجهزة Cisco IOS XE التي تشغل BGP مع تكوينات EVPN باستخدام 'show bgp l2vpn evpn summary'

- تطبيق تصحيحات Cisco الأمنية فوراً (cisco-sa-20171004-evpn)

- مراقبة جلسات BGP للكشف عن إعادة التعيين غير المتوقعة أو شذوذ جداول التوجيه



2. إرشادات التصحيح:

- ترقية Cisco IOS XE إلى إصدارات البرامج المصححة المحددة في إرشادات Cisco

- جدولة نوافذ صيانة طارئة للبنية التحتية الحرجة للتوجيه

- اختبار التصحيحات في بيئة مختبرية قبل النشر في الإنتاج



3. ضوابط تعويضية:

- تنفيذ BGP TTL Security Hack (GTSM) لتقييد إنشاء جلسات BGP للأقران المتصلين مباشرة

- تكوين حدود البادئة القصوى لـ BGP للكشف عن تلف جدول التوجيه

- تمكين تخميد مسار BGP وتنفيذ تصفية البادئات

- استخدام سياسات مستوى التحكم (CoPP) لتحديد معدل حركة BGP

- تنفيذ مصادقة أقران BGP باستخدام MD5 أو TCP-AO



4. قواعد الكشف:

- مراقبة تقلبات جلسات BGP غير المتوقعة عبر SNMP وسجلات النظام

- التنبيه عند إعادة تشغيل الأجهزة المرتبطة بنشاط BGP EVPN

- تنفيذ مراقبة NetFlow/IPFIX لأنماط حركة BGP الشاذة

- إنشاء توقيعات IDS/IPS لرسائل BGP EVPN UPDATE المشوهة

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC-2:3-1 (Network Security) ECC-2:3-4 (Infrastructure Security) ECC-2:5-1 (Vulnerability Management) ECC-2:4-2 (Security Monitoring)

🔵 SAMA CSF

3.3.3 (Network Security Management) 3.3.5 (Vulnerability Management) 3.4.1 (Security Event Monitoring) 3.3.1 (Infrastructure Security)

🟡 ISO 27001:2022

A.8.9 (Configuration Management) A.8.8 (Management of Technical Vulnerabilities) A.8.20 (Network Security) A.8.16 (Monitoring Activities)

🟣 PCI DSS v4.0

PCI DSS 6.3.3 (Patching Security Vulnerabilities) PCI DSS 11.3 (Vulnerability Scanning) PCI DSS 1.2 (Network Security Controls)

🔗 References & Sources 0

No references.

📦 Affected Products / CPE 1 entries

Cisco:IOS XE Software

📊 CVSS Score

9.0

/ 10.0 — Critical

📋 Quick Facts

Severity Critical

CVSS Score9.0

EPSS0.94%

Exploit ✓ Yes

Patch ✓ Yes

CISA KEV🇺🇸 Yes

KEV Due Date2022-03-24

Published 2022-03-03

Source Feed cisa_kev

🇸🇦 Saudi Risk Score

8.5

/ 10.0 — Saudi Risk

🏷️ Tags

kev actively-exploited

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2017-12319

Introduce Yourself

Sign In Required