Denial‑of‑Service in Cisco IOS XE EVPN BGP (CVE‑2017‑12319) Threatens Network Availability
What It Is – Cisco disclosed CVE‑2017‑12319, a flaw in the Border Gateway Protocol (BGP) implementation over Ethernet Virtual Private Network (EVPN) in IOS XE. An unauthenticated, remote attacker can send crafted packets that cause the device to reload or corrupt the BGP routing table.
Exploitability – The vulnerability is publicly known; no proof‑of‑concept is required beyond sending malformed BGP packets. CVSS v3.1 base score 7.5 (High).
Affected Products – Cisco IOS XE Software on platforms that run EVPN BGP (e.g., ASR 1000, ISR 4000 series).
Why It Matters for Trust & Control Assurance
- Availability control – The flaw directly tests the control objective of ensuring continuous operation of critical network services.
- Patch‑management evidence – Demonstrating timely remediation provides defensible audit evidence of an effective vulnerability‑remediation process.
- Continuous monitoring – Detecting unexpected reloads or BGP table changes is essential for a real‑time assurance posture that enterprise buyers now demand.
Recommended Actions
- Inventory all Cisco IOS XE devices that run EVPN BGP.
- Verify current software versions against Cisco’s advisory.
- Apply the Cisco‑released patch or upgrade to a fixed release.
- Update your CMDB with the patched version and retain the patch‑install logs.
- Enable monitoring for device reload events and BGP routing anomalies.
- Document remediation steps to satisfy audit‑readiness requirements.
Source: CISA KEV – CVE‑2017‑12319