How to Fix CVE-2017-12232: Cisco IOS ISR G2 Reload DoS

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-24. Treat it as active exploitation, not theoretical.

What is CVE-2017-12232?

CVE-2017-12232 is a denial-of-service vulnerability in the Ethernet frame handling of Cisco Integrated Services Routers Generation 2 (ISR G2) running Cisco IOS releases 15.0 through 15.6. The root cause is a misclassification of Ethernet frames inside the device's protocol implementation. When the router receives a specifically crafted Ethernet frame, the flaw causes it to reload, dropping every session it was carrying and taking the network segment behind it offline until the device finishes rebooting.

This is purely an availability problem. It is classified under CWE-399 (Resource Management Errors), and the CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms it: confidentiality and integrity impact are both None, and only availability is High. There is no code execution, no privilege escalation, and no data exposure here. The single consequence is an attacker-triggered reload, repeatable as often as the attacker can resend the frame.

Two properties matter for risk assessment. First, the attacker needs no authentication. they do not need credentials on the router. Second, the attack vector is Adjacent (AV:A): the attacker must be able to put a raw Ethernet frame onto a Layer 2 segment the router is directly attached to. This cannot be triggered by ordinary routed traffic arriving from across the internet. The realistic threat model is a compromised host, a rogue device, or an untrusted endpoint sitting on a directly connected LAN or access VLAN. Cisco tracks the fix internally as bug ID CSCvc03809, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2022-03-03.

Spot the symptom

The operational symptom is a router that reloads unexpectedly, often repeatedly, with no configuration change to explain it. After a reload, check the crash context:

# Confirm you are on an affected ISR G2 and IOS train
show version | include (Version|uptime|System restarted)

# Look at the reload reason and any crashinfo left behind
show version | include reason
show logging | include (RELOAD|crash|%SYS-5-RELOAD)
dir flash:/crashinfo*

If show version reports a Cisco ISR G2 platform running an IOS release in the 15.0–15.6 range, and reloads correlate with traffic from a particular adjacent segment, the device is in scope. Confirm the exact build against the Cisco Software Checker referenced in the advisory rather than guessing from the major version alone.

How to fix CVE-2017-12232

The fix is to upgrade the affected ISR G2 to an IOS build where CSCvc03809 is resolved. Cisco did not ship a single "fixed-in" version for every platform, the first fixed release differs per IOS train and router model. Do not guess. Open advisory cisco-sa-20170927-rbip-dos, use the embedded Cisco Software Checker, enter your exact model and current IOS release, and it returns the specific patched build for your image. Download that build and follow the upgrade steps below.

Cisco IOS image upgrade

# Vendor advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-rbip-dos
enable
show version | include Version
copy running-config startup-config
copy tftp: flash:
! upload the patched image, then:
boot system flash:<patched-image>.bin
reload

Complete operator runbook (network appliance)

Run this from your management workstation (Linux/macOS or Windows with a TFTP server reachable). It shells into the device, backs up the running config, transfers the patched image, and reloads.

# Vendor advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-rbip-dos
#!/usr/bin/env bash
# CVE-2017-12232 fix runbook for Cisco IOS ISR G2 (bug CSCvc03809)
# Target build: the fixed release returned by the Cisco Software Checker

set -euo pipefail
DEVICE="${1:?usage: $0 <device-ip> <patched-image-file> <tftp-server-ip>}"
IMAGE="${2:?patched image filename required}"
TFTP="${3:?tftp server ip required}"
LOG="/var/log/cve-2017-12232-$(date +%Y%m%d-%H%M%S).log"

echo "[1/4] Pulling current config from $DEVICE"
ssh admin@"$DEVICE" "show version" | tee -a "$LOG"
ssh admin@"$DEVICE" "copy running-config tftp://$TFTP/cve-2017-12232-pre.cfg"

echo "[2/4] Uploading patched image $IMAGE via TFTP"
ssh admin@"$DEVICE" "copy tftp://$TFTP/$IMAGE flash:$IMAGE" | tee -a "$LOG"

echo "[3/4] Setting boot image and reloading"
ssh admin@"$DEVICE" "configure terminal
 boot system flash:$IMAGE
 end
 write memory
 reload" | tee -a "$LOG"

echo "[4/4] Wait ~5 minutes, then verify"
sleep 300
ssh admin@"$DEVICE" "show version | include Version" | tee -a "$LOG"
echo "Compare reported version against the fixed build from the Software Checker"

Plan the reload into a maintenance window: the upgrade itself requires a reboot, so the device will be offline for several minutes while it boots the new image. Verify with show version afterward and confirm the running release matches the fixed build the Software Checker returned.

If you can't patch immediately

There is no feature you can disable to remove this flaw: it lives in core Ethernet frame handling, not an optional service. Until you can schedule the upgrade, the only meaningful mitigation is to shrink the set of hosts that can put a frame onto the router's directly connected segments, because the attack requires Layer 2 adjacency.

Restrict Layer 2 access to the router

Limit which devices share a broadcast domain with the affected router. On the access switches feeding it, lock down the relevant ports and segregate untrusted endpoints into separate VLANs so they cannot reach the router's interfaces at Layer 2:

# On the access switch port facing untrusted endpoints
configure terminal
interface range GigabitEthernet1/0/10 - 24
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation restrict
 storm-control broadcast level 1.00
end
write memory

Harden the management plane

This does not stop the DoS frame, but it limits blast radius by keeping the router's control access tied to a trusted subnet while you wait for the maintenance window:

# Cisco IOS: restrict VTY/management access to a trusted subnet
configure terminal
access-list 99 permit 10.0.0.0 0.255.255.255
line vty 0 15
 access-class 99 in
end
write memory

None of these controls remove the vulnerability. They only reduce who can reach the router at Layer 2 to send the crafted frame. Treat them as a stopgap, and complete the IOS upgrade as soon as a window allows.

Verify the fix

After the upgrade, confirm three things on the device itself, there is no Linux package or Windows hotfix to check, because this is router firmware:

# 1. Running release matches the fixed build from the Software Checker
show version | include (Version|System image)

# 2. The device booted the new image, not the old one in flash
show bootvar

# 3. No new unexplained reloads since the upgrade
show version | include (uptime|restarted)
show logging | include RELOAD

If show version reports the fixed release, show bootvar points at the new image, and the router holds uptime without further crafted-frame reloads from the previously affected segment, the remediation is complete. Re-run the Cisco Software Checker against the new release to double-confirm it is no longer flagged for CSCvc03809.

References

• Official vendor advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-rbip-dos
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-12232
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• http://www.securitytracker.com/id/1039452
• http://www.securityfocus.com/bid/101044
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12232

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Why a reload vulnerability still matters

It is tempting to dismiss a denial-of-service bug as low-stakes next to remote code execution, and CISA's own SSVC scoring rates the technical impact as only "partial." But CISA still placed CVE-2017-12232 on the Known Exploited Vulnerabilities catalog, which means working attack code is in use against real networks. On an ISR G2, a reload is not a minor blip: these routers commonly sit at branch-office or WAN-edge positions, so a repeatable reload can knock an entire site offline for as long as the attacker keeps sending frames.

The adjacency requirement is what shapes the real-world risk. Because the attacker must be on a directly connected Layer 2 segment, the dangerous scenario is an insider, a compromised endpoint, or an unmanaged device on a flat network that includes the router. That is exactly why the interim mitigations focus on Layer 2 segmentation and port security rather than on perimeter firewall rules. a border ACL does nothing against a frame that never crosses a routed boundary. The durable fix remains the IOS upgrade to the build the Cisco Software Checker identifies for your platform.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2017-12235: Improper input validation in Cisco IOS
• How to Fix CVE-2017-6736: Buffer overflow in IOS
• How to Fix CVE-2017-12233: Improper input validation in Cisco IOS
• How to Fix CVE-2017-6740: Buffer overflow in IOS
• How to Fix CVE-2017-12319: Improper input validation in Cisco IOS XE