How to Fix CVE-2017-12319: Improper input validation in Cisco IOS XE

WARNING: This vulnerability is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03). Federal civilian agencies must remediate by 2022-03-24. Treat it as active exploitation, not theoretical.

What is CVE-2017-12319?

CVE-2017-12319 is a denial-of-service flaw in the BGP EVPN (Ethernet VPN) implementation of Cisco IOS XE Software. It is tracked as CWE-20, improper input validation, and Cisco assigned it bug IDs CSCui67191 and CSCvg52875. This is purely an availability bug. It does not give an attacker code execution, a shell, or read access to data. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms that: confidentiality and integrity impact are None, only availability is High.

The root cause is a parsing defect that crept in as Cisco evolved its implementation of the BGP MPLS-based Ethernet VPN draft (RFC 7432) across IOS XE releases. When the router receives a BGP Inclusive Multicast Ethernet Tag Route update or a BGP EVPN MAC/IP Advertisement Route update, the code can miscalculate the IP address length field inside that route. A crafted update that exploits this miscalculation makes the device either reload outright (a hard DoS) or corrupt its BGP routing table, which destabilises the network until the table is rebuilt.

Two preconditions matter, and they narrow the exposure considerably:

• BGP EVPN must be configured. The record is explicit: if the device is not configured for EVPN, it is not vulnerable. Routers running plain BGP, OSPF, EIGRP, or no routing protocol at all are unaffected by this CVE.
• The attacker needs an established BGP session. The malicious update has to arrive from a BGP peer on a session that is already up. The attacker is unauthenticated in the sense that no login or privilege is required, but they must be in a position to speak BGP to the router as a peer: either a compromised legitimate peer, a misconfigured neighbour, or an adversary on the path who can inject into an existing session.

This is why the CVSS attack complexity is High and the score lands at 5.9 (Medium) rather than in critical territory. Despite the medium score, CISA added it to the Known Exploited Vulnerabilities catalog in March 2022, so treat it as a real-world target on any EVPN-enabled IOS XE box.

How to confirm you are affected

Two checks decide your exposure: the software version and whether BGP EVPN is configured.

First, check the IOS XE version from the device CLI:

show version | include Cisco IOS XE Software

Any IOS XE release earlier than 16.3 is in the vulnerable range. Release 16.3 and later carry the fix.

Second, confirm whether BGP EVPN is actually configured. If it is not, this CVE does not apply to you regardless of version:

# Look for an l2vpn evpn address-family under the BGP process
show running-config | section router bgp
show running-config | include l2vpn evpn
show bgp l2vpn evpn summary

If show bgp l2vpn evpn summary returns an error such as “EVPN not active” or no address-family is present in the BGP config, you are not exposed to CVE-2017-12319. If EVPN is active and your version is below 16.3, plan the upgrade.

How to fix CVE-2017-12319

The fix is to upgrade Cisco IOS XE Software to release 16.3 or later, which is the first release that corrects the EVPN route-length parsing. Cisco does not ship a configuration-only patch for this defect; the corrected code is in the image, so a software upgrade is the real remediation. There is no Linux package, Windows update, or third-party patch involved, this is a Cisco IOS XE image upgrade.

Before upgrading, confirm the exact fixed release for your specific platform and train in Cisco's advisory cisco-sa-20171103-bgp. Cisco's Software Download portal and the Cisco IOS Software Checker tell you the recommended fixed image for your hardware. Customers with a service contract download the image; if you do not have one, Cisco TAC provides fixed software for vulnerabilities listed in a security advisory.

Upgrading IOS XE to 16.3 or later

The exact procedure depends on the platform (ASR 1000, CSR 1000v, Catalyst, ISR 4000, and so on) and on whether the device runs in bundle mode or install mode. The outline below covers a copy-to-flash, set-boot, reload sequence. verify each step against the upgrade guide for your platform first.

! From an enable prompt on the device
enable
show version | include Cisco IOS XE Software   ! record the current version
copy running-config startup-config             ! save current config

! Copy the fixed 16.3+ image to flash (TFTP/FTP/SCP/USB as available)
copy tftp: flash:

! Verify the image landed intact before booting it
verify flash:<fixed-16.3-or-later-image>.bin

! Point the boot system at the fixed image
configure terminal
 no boot system
 boot system flash:<fixed-16.3-or-later-image>.bin
end
write memory

! Reload during a maintenance window
reload

After the device comes back up, verify the running version:

show version | include Cisco IOS XE Software

Confirm the reported release is 16.3 or later. There is no library or service to restart, once the device reloads onto the fixed image, the EVPN parsing defect is gone.

If you can't upgrade immediately

There is no Cisco-published workaround that fully neutralises this bug short of upgrading. Because the attack arrives over an established BGP session from a peer, the realistic interim controls reduce who can become a peer and feed you EVPN routes. None of these replace the upgrade.

• Authenticate BGP sessions. Configure TTL security (GTSM) and MD5/keychain authentication on your BGP EVPN neighbours so an off-path attacker cannot inject updates into the session. This raises the bar but does nothing against a compromised or malicious legitimate peer.
• Lock down BGP peering at the edge. Use infrastructure ACLs and control-plane policing (CoPP) to ensure TCP/179 (BGP) is only reachable from your known peer addresses, not from arbitrary hosts.
• Limit the EVPN trust boundary. Only run BGP EVPN with peers you control inside the EVPN fabric. Treat any EVPN session that crosses an untrusted boundary as a direct path to this DoS.

! Example: harden an EVPN BGP neighbour with TTL security + MD5
configure terminal
router bgp 65000
 neighbor 10.0.0.2 ttl-security hops 1
 neighbor 10.0.0.2 password 7 <your-key>
end
write memory

Frequently asked questions

My routers run BGP but not EVPN. Am I affected by CVE-2017-12319?

No. The vulnerability is specific to the BGP EVPN (Ethernet VPN) feature. The CVE record states plainly that if the device is not configured for EVPN, it is not vulnerable. Run show running-config | include l2vpn evpn: if nothing comes back, this CVE does not apply to you, even on a pre-16.3 image.

What exactly happens if this is exploited, can someone take over my router?

No takeover. This is a denial-of-service issue only. A crafted EVPN route update makes the device reload or corrupts its BGP routing table, both of which knock the device or the network offline. The CVSS vector shows confidentiality and integrity impact as None and availability as High, so there is no code execution and no data exposure. just an outage.

What version do I upgrade to?

Cisco IOS XE Software release 16.3 is the first release that fixes the EVPN route-length parsing; all releases prior to 16.3 that support BGP EVPN are affected. Confirm the exact recommended fixed image for your specific platform in Cisco advisory cisco-sa-20171103-bgp and the Cisco IOS Software Checker before downloading.

It is only rated Medium (5.9). Why is it on the CISA KEV list?

Severity score and real-world exploitation are separate signals. The score is 5.9 partly because exploitation requires an established BGP session and high attack complexity. CISA still added it to the Known Exploited Vulnerabilities catalog on 2022-03-03 because working attack activity has been observed, which makes patching mandatory for U.S. federal agencies and strongly advisable for everyone running EVPN on IOS XE.

References

• Official vendor advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171103-bgp
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-12319
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• http://www.securityfocus.com/bid/101676
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12319

Written by Sai Kiran Pandrala on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2017-12234: Improper input validation in Cisco IOS
• How to Fix CVE-2017-6744: Buffer overflow in IOS
• How to Fix CVE-2017-3881: Improper Input Validation in Cisco IOS and IOS XE
• How to Fix CVE-2017-6627: Cwe-399 in Cisco IOS and Cisco IOS XE
• How to Fix CVE-2017-6742: Improper Restriction of Operations within the Bounds of a Memory Buffer