// For flags

CVE-2017-12217

 

Severity Score

5.3
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture Evolution (SAE) Gateways could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation of GPRS Tunneling Protocol packet headers. An attacker could exploit this vulnerability by sending a malformed GPRS Tunneling Protocol packet to an affected device. A successful exploit could allow the attacker to cause the GTPUMGR process on an affected device to restart unexpectedly, resulting in a partial DoS condition. If the GTPUMGR process restarts, there could be a brief impact on traffic passing through the device. Cisco Bug IDs: CSCve07119.

Una vulnerabilidad en el gestor de paquetes de entrada del protocolo de túnel GPRS (General Packet Radio Service) de Cisco ASR 5500 System Architecture Evolution (SAE) Gateways podría permitir a un atacante remoto no autenticado provocar una denegación de servicio (DoS) parcial en el dispositivo afectado. Esta vulnerabilidad se debe a una validación incorrecta de entradas de las cabeceras de los paquetes de protocolo de túnel GPRS. Un atacante podría explotar esta vulnerabilidad mediante el envío de un paquete de protocolo de túnel GPRS mal formado a un dispositivo afectado. Una explotación con éxito podría permitir que el atacante provoque que el proceso GTPUMGR de un dispositivo afectado se reinicie de manera inesperada, lo que da lugar a una denegación de servicio (DoS) parcial. Si el proceso GTPUMGR se reinicia, podría produirse un leve impacto en el tráfico que pasa a través del dispositivo. Cisco Bug IDs: CSCve07119.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-08-03 CVE Reserved
  • 2017-09-07 CVE Published
  • 2023-03-10 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
Asr 5500 Firmware
Search vendor "Cisco" for product "Asr 5500 Firmware"
--
Affected
in Cisco
Search vendor "Cisco"
Asr 5500
Search vendor "Cisco" for product "Asr 5500"
--
Safe