vulnwire
7.8high

CVE-2017-12243in critical feed1 exploit

A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
77.1%
percentile 100%
Public exploits
1
Exploit-DB

A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to obtain root shell privileges on the device, aka Command Injection. The vulnerability is due to improper validation of string input in the shell application. An attacker could exploit this vulnerability through the use of malicious commands. A successful exploit could allow the attacker to obtain root shell privileges on the device. Cisco Bug IDs: CSCvf20741, CSCvf60078.

Exploit prediction (EPSS)

77.07% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-44052 Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution · remote · 2017-11-01

CVSS scores

Assigned byVersionScoreVector
NVD3.07.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • n/a Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • securityfocus.com /bid/101652 · vdb-entry, x_refsource_BID, x_transferred
  • tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-arce · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1039719 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.