CVE-2017-12237

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. This vulnerability affects Cisco devices that have the Internet Security Association and Key Management Protocol (ISAKMP) enabled. Although only IKEv2 packets can be used to trigger this vulnerability, devices that are running Cisco IOS Software or Cisco IOS XE Software are vulnerable when ISAKMP is enabled. A device does not need to be configured with any IKEv2-specific features to be vulnerable. Many features use IKEv2, including different types of VPNs such as the following: LAN-to-LAN VPN; Remote-access VPN, excluding SSL VPN; Dynamic Multipoint VPN (DMVPN); and FlexVPN. Cisco Bug IDs: CSCvc41277.

• CWE-399

• http://www.securityfocus.com/bid/101037Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039460Broken Link, Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ikeVendor Advisory
• http://www.securityfocus.com/bid/101037Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039460Broken Link, Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ikeVendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12237US Government Resource

Published

Sep 29, 2017

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12231A vulnerability in the implementation of Network Address Tra…7.5
• CVE-2017-12232A vulnerability in the implementation of a protocol in Cisco…6.5
• CVE-2017-12233Multiple vulnerabilities in the implementation of the Common…7.5
• CVE-2017-12234Multiple vulnerabilities in the implementation of the Common…7.5
• CVE-2017-12235A vulnerability in the implementation of the PROFINET Discov…7.5
• CVE-2017-12236A vulnerability in the implementation of the Locator/ID Sepa…
• CVE-2017-12238A vulnerability in the Virtual Private LAN Service (VPLS) co…6.5
• CVE-2017-12239A vulnerability in motherboard console ports of line cards f…6.8
• CVE-2017-1224IBM Tivoli Endpoint Manager uses weaker than expected crypto…
• CVE-2017-12240The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and …9.8
• CVE-2017-12243A vulnerability in the Cisco Unified Computing System (UCS) …
• CVE-2017-12244A vulnerability in the detection engine parsing of IPv6 pack…