Yes. CISA added CVE-2017-12232 to its Known Exploited Vulnerabilities catalogue on 3 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service.
What “being exploited in the wild” means for a Cisco router CVE
For a routing device vulnerability, the practical question is not whether the flaw is theoretically exploitable, but whether there is evidence that attackers are already using it. CISA’s KEV listing is the key signal here: once a CVE is added, defenders should treat it as an active exposure, not a future possibility. That changes triage priority, outage planning, and incident response timing.
When a router CVE can trigger a reload, the security issue is also an availability issue. The operational impact may be immediate, because even unauthenticated adjacent access can be enough to disrupt traffic or management planes. For that reason, “exploited in the wild” usually means a vulnerability management decision has become a resilience decision as well.
For edge-device exposure and exploitability context, see Edge Device Security Guide and Zero-Day and Exploited Vulnerabilities Guide.
How to confirm exposure and decide whether the device needs urgent action
Start with inventory and version confirmation. The relevant questions are whether you have Cisco Integrated Services Routers Generation 2 in scope, whether they are running the affected Cisco IOS code path, and whether the device is reachable from an adjacent network segment that an attacker could realistically access. If you cannot answer those three questions quickly, you do not yet have enough visibility for safe prioritisation.
Then compare your evidence sources with authoritative records rather than relying on informal exploit chatter. The vendor advisory and the CISA KEV catalogue should be the first stop for version detail, required action, and current status. That is especially important because edge-device advisories often have environment-specific constraints that are easy to misstate from memory.
Use the official records at CVE Program, NIST National Vulnerability Database, and CISA Known Exploited Vulnerabilities Catalog.
What to do if patching or replacement cannot happen immediately
If remediation must wait, the goal is to reduce reachable attack surface and make the reload path harder to trigger. That usually means tightening adjacency, limiting who can reach the device, and reviewing whether management traffic, monitoring paths, and routing adjacencies are overexposed. For edge infrastructure, reducing access paths is often the only control that changes risk fast enough while a maintenance window is negotiated.
Because the reported effect is a denial of service, you should also assume that an outage event could be deliberate rather than accidental. Keep configuration backups, outage contacts, rollback steps, and service-owner communication ready before you attempt a change. If the device is business-critical, coordinate the workaround as an availability control, not just a security control.
Where prioritisation is uncertain, pair the KEV signal with exploit-likelihood triage using FIRST EPSS and use Vulnerability Management Guide for remediation sequencing, exception handling, and verification discipline.
Risk and Threat Considerations
Edge routers sit on a high-value trust boundary, so an actively exploited weakness can become both an outage mechanism and a foothold for broader network disruption. A reload-causing flaw is attractive because it is simple to abuse, hard to ignore, and can create repeated service instability if the vulnerable condition remains exposed.
Failure mechanism: An adjacent attacker reaches the affected IOS implementation and triggers the fault path that forces the router to reload, producing denial of service without needing authentication.
Impact: Network interruption, loss of routing availability, and possible secondary disruption to connected services, monitoring, and dependent business systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited router CVEs require prioritized discovery, remediation, and exception tracking. |
| Recommendation — Prioritize KEV-listed router flaws for rapid remediation and verify exposure before accepting any exception. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE requires ongoing exposure checking and timely response to confirmed exploitation. |
| CM-6 — Configuration Settings | Reducing reachable attack paths on edge routers depends on enforced secure configuration. | |
| Recommendation — Scan for affected devices, confirm exposure, and track remediation to closure. Harden router configuration to restrict exposure and remove unnecessary reachable services. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified and Documented | You must identify whether ISR G2 devices are present and exposed before remediation. |
| RS.MA-01 — Mitigation is Executed | Confirmed exploitation requires prompt containment and remediation actions. | |
| Recommendation — Inventory affected routers and document whether the vulnerable condition is present. Execute containment or remediation quickly once exposure is confirmed. | ||
Practitioner Guidance
What to prioritise: Treat any KEV-listed router CVE as an operationally urgent exposure until you have confirmed non-exposure or completed remediation. If the device is internet-adjacent, business-critical, or used as a shared upstream path, move it ahead of routine vulnerability queues.
What to verify: Verify exact device model, IOS branch, adjacency exposure, and whether compensating controls genuinely reduce the reachable attack path. Do not trust a generic asset record if it does not identify the router class and software family precisely.
Decision rule: If the device can be reached from a segment an attacker could plausibly traverse, assume the denial-of-service condition is materially relevant and escalate to the network and operations owners before waiting for a normal patch cycle.
Practitioner takeaway: With KEV-listed infrastructure flaws, the right question is not “is there a patch ticket,” but “how quickly can we remove or constrain the exposed attack path without creating a bigger outage.”
Related resources from NHI Mgmt Group
- CVE-2017-12232 (Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service)
- Is CVE-2018-0154 (Cisco IOS Software Integrated Services Module for VPN Denial-of-Service) being exploited in the wild?
- Is CVE-2017-12319 (Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service) being exploited in the wild?
- Is CVE-2017-12231 (Cisco IOS Software Network Address Translation Denial-of-Service) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org