Denial‑of‑Service in Cisco IOS CIP Feature (CVE‑2017‑12233) Threatens Industrial Network Devices
What It Is – Cisco IOS software’s implementation of the Common Industrial Protocol (CIP) contains a flaw that allows an unauthenticated, remote attacker to trigger a device reload, causing a denial‑of‑service condition.
Exploitability – The vulnerability is publicly disclosed (CVE‑2017‑12233) and can be weaponised without credentials; proof‑of‑concept code exists. CVSS v3.1 base score is 7.5 (High).
Affected Products – Cisco IOS releases that include the CIP feature (all affected versions listed in Cisco’s advisory).
Why It Matters for Trust & Control Assurance
- Availability controls – The flaw directly tests the control objective of maintaining service continuity; unpatched devices break the “system availability” assurance that auditors expect.
- Patch‑management evidence – Continuous monitoring of firmware versions and timely remediation are key pieces of defensible audit evidence across frameworks (e.g., NIST CSF, ISO 27001).
- Supply‑chain diligence – Demonstrating that third‑party network gear is kept up‑to‑date is a core signal of a mature vendor‑risk posture that enterprise buyers now demand.
Recommended Actions
- Inventory all Cisco IOS devices exposing the CIP feature.
- Verify firmware versions against Cisco’s advisory and apply the recommended patches immediately.
- Record patch‑application dates and retain logs as evidence for control‑mapping audits.
- Enable continuous vulnerability‑scanning of network assets to detect future gaps.
Source: CISA KEV – CVE‑2017‑12233