CVE-2017-12238: Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability

CVE-2017-12238 is a denial-of-service vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS on Cisco Catalyst 6800 Series Switches. An unauthenticated attacker on an adjacent network segment could trigger it and disrupt switch availability. For teams running these platforms in campus or data-center fabrics, loss of a Catalyst 6800 can interrupt VPLS-based Layer-2 services and the traffic that depends on them.

Because the flaw requires only adjacent reachability and no credentials, it matters wherever VPLS is enabled on these switches. Confirm exact impact and fixed software against the vendor advisory before prioritizing remediation.

How it works

The weakness is classified as CWE-399 (Resource Management Errors). In the VPLS implementation inside Cisco IOS on the Catalyst 6800 Series, improper handling of certain protocol conditions can exhaust or corrupt internal resources that the switch needs to keep the VPLS process stable.

An unauthenticated, adjacent attacker sends crafted traffic that reaches the VPLS code path. The switch fails to manage the associated resources correctly, leading to a denial-of-service condition that can halt or severely degrade VPLS forwarding. No remote unauthenticated exploitation across Layer-3 boundaries is described; adjacency is required. Specific packet formats and exact failure modes are not detailed in the public summary and must be taken from the vendor advisory.

Am I affected? How to find it in your systems

Cisco Catalyst 6800 Series Switches running Cisco IOS with VPLS configured are the only platforms named. These chassis commonly appear as core or aggregation switches in enterprise campus and data-center networks that extend Layer-2 domains across sites via VPLS.

• Inventory every Catalyst 6800: use network management tools, CLI “show version” and “show inventory”, or configuration-management databases to list chassis, supervisors, and running IOS images.
• Check whether VPLS is enabled: look for VPLS-related configuration (bridge-domain, xconnect, or VPLS pseudowire statements) and confirm the feature is active.
• Compare the installed IOS release against the fixed versions listed in the Cisco advisory for CVE-2017-12238; do not assume any particular release is vulnerable or safe without that check.
• Telemetry signs of exploitation are generic for this class: sudden VPLS process crashes, unexpected supervisor reloads, interface or pseudowire flaps, and syslog or SNMP traps reporting VPLS or resource errors. Correlate any such events with adjacent-segment traffic anomalies. No unique indicators are supplied in the public record.

How to remediate

Patch first. Apply the Cisco IOS updates identified in the vendor advisory for CVE-2017-12238 on every affected Catalyst 6800. Follow Cisco’s published installation and reload procedures, and verify the new image with “show version” after the change.

After patching, reduce the attack surface for similar resource-management issues:

• Disable VPLS on any switch or interface where it is not required.
• Restrict which adjacent devices may send VPLS control or data plane traffic through interface ACLs or control-plane policing.
• Keep IOS images current and subscribe to Cisco security notifications so future VPLS or resource-handling fixes are applied promptly.

If you can't patch immediately

Until the vendor update can be deployed, apply compensating controls that limit adjacency and visibility of the VPLS service:

• Segment the switches so that only trusted peer devices share the same Layer-2 domain; use private VLANs, VRFs, or firewall rules to block untrusted adjacent hosts.
• If a network security device can inspect VPLS-related traffic, implement temporary filters or rate limits that drop anomalous frames destined to the VPLS process (virtual patching).
• Disable VPLS entirely on non-essential switches or interfaces.
• Increase monitoring: alert on VPLS process failures, unexpected reloads, and spikes in control-plane CPU or memory. Retain packet captures of adjacent traffic for later analysis.

These steps only reduce risk; they do not eliminate the underlying resource-management flaw. Schedule the official patch as soon as operationally feasible.

If your data may have been exposed

This vulnerability is a denial-of-service issue; the public record does not document data exfiltration or ransomware use. Nevertheless, any successfully exploited denial-of-service condition can be a precursor to broader compromise if an attacker gains a foothold elsewhere. If you suspect your environment was targeted, review adjacent-network logs and device crashinfo files, and consider standard incident-response steps. You can also run a free exposure scan of your email addresses against known breach data sets to check whether credentials or personal information have appeared in prior unrelated incidents.