CVE-2017-12222: Input Validation

Published Sep 28, 2017

Updated

A vulnerability in the wireless controller manager of Cisco IOS XE could allow an unauthenticated, adjacent attacker to cause a restart of the switch and result in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted association request. An exploit could allow the attacker to cause the switch to restart. This vulnerability affects Cisco Catalyst 3650 and 3850 switches running IOS XE Software versions 16.1 through 16.3.3, and acting as wireless LAN controllers (WLC). Cisco Bug IDs: CSCvd45069.

Affected Software

13 affected components

Cisco IOS XE=16.1.1

Cisco IOS XE=16.1.2

Cisco IOS XE=16.1.3

Cisco IOS XE=16.1.3a

Cisco IOS XE=16.1.4

Cisco IOS XE=16.2.1

Cisco IOS XE=16.2.2

Cisco IOS XE=16.2.2a

Cisco IOS XE=16.2.3

Cisco IOS XE=16.3.1

Cisco IOS XE=16.3.1a

Cisco IOS XE=16.3.2

Cisco IOS XE=16.3.3

Event History

Sep 28, 2017

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-12222?

CVE-2017-12222 has a high severity rating due to its ability to cause a denial of service condition.

How do I fix CVE-2017-12222?

To fix CVE-2017-12222, you should upgrade to a patched version of Cisco IOS XE that addresses this vulnerability.

Which versions of software are affected by CVE-2017-12222?

CVE-2017-12222 affects specific versions of Cisco IOS XE including 16.1.1, 16.1.2, 16.1.3, 16.1.3a, 16.1.4, 16.2.1, 16.2.2, 16.2.2a, 16.2.3, 16.3.1, 16.3.1a, and 16.3.2.

What type of attack does CVE-2017-12222 allow?

CVE-2017-12222 allows an unauthenticated, adjacent attacker to restart the switch, leading to a denial of service.

Is input validation a concern in CVE-2017-12222?

Yes, CVE-2017-12222 is due to insufficient input validation in the wireless controller manager of Cisco IOS XE.