Back

CVE-2017-12240

CRITICAL CISA KEV

The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.

Published: Sep 29, 2017 Modified: Jun 17, 2026
CWE-20 CWE-119

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (1)

Vendor Product Version
cisco ios * ≥ 12.2

GitHub Security Advisory GHSA-q8rh-r33q-hvj2

The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a...

References (11)

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 13.88%

Top 4% most likely to be exploited

Threat Score 73.4 / 100

CISA Known Exploited

Date Added: 2022-03-03
Due Date: 2022-03-24
Required Action:

Apply updates per vendor instructions.

Data Sources

NVD CISA KEV EPSS GitHub