CVE-2017-12235: Cisco IOS Software for Industrial Ethernet Switches – Remote Denial‑of‑Service Vulnerability
What It Is – A flaw in the PROFINET Discovery and Configuration Protocol (PN‑DCP) implementation of Cisco IOS for Industrial Ethernet Switches allows an unauthenticated, remote attacker to trigger a device reload, resulting in a denial‑of‑service condition.
Exploitability – The vulnerability is publicly disclosed (CVE‑2017‑12235) and can be exploited without credentials. No public exploit code is required; a crafted PN‑DCP packet is sufficient. The CVSS v3.0 base score is 7.5 (High).
Affected Products – Cisco IOS Software running on Cisco Industrial Ethernet Switches that support PROFINET (e.g., Catalyst 9000 series for OT environments).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous control mapping of OT device firmware versions against your framework of record; evidence of patch status is a core audit artifact.
- Highlights gaps in monitoring for unexpected device reloads, a control that supports incident‑response readiness and evidences due‑diligence.
- Reinforces the importance of segmentation and access‑control policies that limit exposure of critical OT assets to untrusted network traffic.
Recommended Actions
- Verify firmware versions on all Cisco Industrial Ethernet Switches and apply Cisco’s security advisory patch immediately.
- Enable logging of PN‑DCP traffic and device reload events; forward logs to a centralized SIEM for continuous monitoring.
- Review network segmentation to ensure OT switches are isolated from untrusted LAN segments.
- Document the remediation steps in your control evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2017‑12235