Cisco IOS XE BGP EVPN Implementation Flaw Remote Denial of Service and Routing Table Corruption Vulnerability (CVE-2017-12319)
Executive & SecOps Summary
SECOPS ASSESSMENTCisco IOS XE Software releases prior to 16.3 with BGP EVPN configuration enabled
Unauthenticated, remote attackers can trigger a device reload or corrupt the BGP routing table, leading to a complete Denial of Service (DoS) and network instability
Upgrade to Cisco IOS XE Software release 16.3 or later, or disable EVPN configurations if not business-critical
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Administrators should upgrade to Cisco IOS XE Software release 16.3 or later. Below is an example of upgrading the image via TFTP:
# Download the patched IOS XE image and set the boot path
copy tftp://10.1.1.100/isr4300-universalk9.16.03.01.SPA.bin bootflash:
configure terminal
no boot system
boot system bootflash:isr4300-universalk9.16.03.01.SPA.bin
write memory
exit
reload2. Temporary Workaround & Hardening Configuration
If the EVPN feature is not required, disable the address family to mitigate the attack vector. Additionally, restrict BGP peering to trusted IP addresses using ACLs:
# Disable BGP EVPN address family if not in use
configure terminal
router bgp 65000
no address-family l2vpn evpn
exit
exit
# Restrict BGP peering access
ip access-list extended BGP_PEER_FILTER
permit tcp host 192.168.10.1 host 192.168.10.2 eq bgp
deny tcp any any eq bgp
exit3. Log Audit & IoC Verification Commands
Verify the current running version, check if EVPN is active, and inspect system logs for unexpected BGP peer resets or reload events:
# Check IOS XE version and BGP configuration
show version | include IOS XE
show running-config | section bgp
# Inspect logs for BGP errors or system reload events
show ip bgp summary
show logging | include %BGP-3-NOTIFICATION|%SYS-2-RELOADStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) implementation within Cisco IOS XE Software (CWE-20). Due to discrepancies in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft across different software releases, the device miscalculates the IP address length field when parsing BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packets.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a specially crafted BGP update packet over an established BGP session to an affected device. When the router attempts to parse the malformed packet, the miscalculated IP address length field triggers a memory parsing error. This results in either an immediate device reload or corruption of the active BGP routing table, both leading to a Denial of Service (DoS) condition.
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, it represents a high-risk threat with active exploitation history. A successful exploit on core routing infrastructure can disrupt enterprise and service provider networks, causing severe downtime, packet loss, and business interruption.
Official Vendor Advisories & References
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. An attacker could exploit this vulnerability by sending a crafted BGP packet to an affected device after the BGP session was established. An exploit could allow the attacker to cause the affected device to reload or corrupt the BGP routing table; either outcome would result in a DoS. The vulnerability may be triggered when the router receives a crafted BGP message from a peer on an existing BGP session. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations. If the device is not configured for EVPN, it is not vulnerable. Cisco Bug IDs: CSCui67191, CSCvg52875.
Frequently Asked SecOps Questions (CVE-2017-12319)
FAQQ1. How critical is CVE-2017-12319 and is it actively exploited in the wild?
CVE-2017-12319 is rated CVSS 5.9 (MEDIUM) with a 30-day EPSS exploitation probability of 5.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2017-12319?
Primary impacted vendors include cisco across ios xe. Scope summary: All Cisco IOS XE Software releases prior to 16.3 configured with BGP EVPN
Q3. What temporary mitigations or workarounds exist for CVE-2017-12319 before patching?
[Mitigation] Upgrade to Cisco IOS XE Software release 16.3 or later, or disable EVPN configurations if not business-critical Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2017-12319
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cisco)
View Category →Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Cisco Secure Firewall Management Center (FMC) Insecure Deserialization Vulnerability (CVE-2026-20131, CVSS 10.0) - Remote Code Execution and Root Privilege Escalation
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.