CVE-2017-12235: Cisco IOS PROFINET packet parsing flaw causes device reload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, causes full device reload, and is listed in CISA KEV as exploited in the wild, though impact is limited to availability.

What it is

Cisco IOS releases 12.2 through 15.6 mishandle ingress PROFINET Discovery and Configuration Protocol (PN-DCP) Identify Request packets, allowing an unauthenticated remote attacker to force a device reload. Devices configured to process PROFINET messages are affected, and PROFINET is enabled by default on base switch module and expansion-unit Ethernet ports starting with IOS 12.2(52)SE. The result is a denial-of-service condition on industrial and other affected switches.

Impact

An attacker can cause the targeted device to reload repeatedly, disrupting network availability and any industrial or operational traffic carried through it. No confidentiality or integrity impact is described; the effect is availability loss only.

Attack surface

The flaw is reached over the network by sending crafted PN-DCP Identify Request packets to a device that processes PROFINET messages, followed by normal PN-DCP Identify Request packets. The CVSS vector shows no privileges and no user interaction required, so it is remotely triggerable by an unauthenticated attacker with network reach to the affected interface.

Exploitation

CVE-2017-12235 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating real-world exploitation, and EPSS shows a 30-day probability of about 7.1 percent (93.9th percentile). References are vendor advisory and government catalog entries; no public exploit code is cited in the record.

What to do

• Apply the Cisco IOS updates specified in the vendor advisory cisco-sa-20170927-profinet; this is the primary fix.
• Where PROFINET is not required, disable PROFINET processing on affected switch and expansion-unit Ethernet ports.
• Restrict network access to PROFINET-capable interfaces using ACLs or segmentation so only trusted industrial hosts can send PN-DCP traffic.
• Monitor for repeated device reloads on PROFINET-enabled switches and treat unexplained reloads as potential exploitation.
• Track remediation against the CISA KEV due date and confirm affected devices are upgraded or isolated.

Detection

• Alert on unexpected or repeated reload/restart events on Cisco IOS devices that process PROFINET.
• Inspect network traffic for PN-DCP Identify Request packets arriving from untrusted or unexpected sources.
• Baseline which hosts legitimately send PROFINET discovery traffic and flag deviations.
• Correlate device reload logs with PN-DCP packet captures to identify crafted-packet triggers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.