CVE-2017-12238: Cisco IOS VPLS memory management flaw crashes Catalyst 6800 line cards

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely triggerable by an adjacent unauthenticated attacker and is listed in CISA KEV as exploited, though it only causes denial of service on a specific hardware and configuration combination.

What it is

Cisco IOS 15.0 through 15.4 on Catalyst 6800 Series Switches has a memory management issue in the VPLS code. An adjacent, unauthenticated attacker can flood VPLS-generated MAC entries into the MAC address table and crash a C6800-16P10G or C6800-16P10G-XL line card, causing a denial of service.

Impact

The attacker can crash the affected line card, taking the device out of service and disrupting traffic through it. No confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable by an adjacent attacker on the network, with no authentication and no user interaction required (CVSS vector AV:A/PR:N/UI:N). The device must run a vulnerable IOS release, use a C6800-16P10G or C6800-16P10G-XL line card with Supervisor Engine 6T, be configured with VPLS, and have that line card as the core-facing MPLS interface.

Exploitation

CVE-2017-12238 is listed in CISA's Known Exploited Vulnerabilities catalog with a 2022-03-03 addition date, indicating known exploitation. EPSS is low at roughly 2.0% 30-day probability (80th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Cisco IOS software update referenced in Cisco advisory cisco-sa-20170927-vpls for affected Catalyst 6800 switches.
• Verify whether the device meets all vulnerable preconditions: IOS 15.0-15.4, C6800-16P10G or C6800-16P10G-XL line card with Supervisor Engine 6T, VPLS configured, and the line card used as the core-facing MPLS interface.
• If patching cannot be done immediately, restrict adjacency to the affected VPLS/MPLS interfaces to trusted network segments.
• Monitor MAC address table growth on affected line cards and treat abnormal VPLS MAC entry counts as an indicator of attack.
• Track CISA KEV remediation due dates for this CVE and confirm closure.

Detection

• Alert on abnormal growth in VPLS-generated MAC entries in the MAC address table of Catalyst 6800 switches.
• Monitor for line card crash, reload, or reset events on C6800-16P10G and C6800-16P10G-XL cards.
• Watch syslog and SNMP traps for VPLS or MAC table related errors preceding a line card failure.
• Baseline normal VPLS MAC entry counts per interface and flag deviations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.