Vulnerability Description
A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to obtain root shell privileges on the device, aka Command Injection. The vulnerability is due to improper validation of string input in the shell application. An attacker could exploit this vulnerability through the use of malicious commands. A successful exploit could allow the attacker to obtain root shell privileges on the device. Cisco Bug IDs: CSCvf20741, CSCvf60078.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Unified Computing System Manager Firmware | - |
| Cisco | Unified Computing System Manager | - |
| Cisco | Firepower 9300 Security Appliance Firmware | - |
| Cisco | Firepower 9300 Security Appliance | - |
| Cisco | Firepower 4100 Next-Generation Firewall Firmware | - |
| Cisco | Firepower 4110 Next-Generation Firewall | - |
| Cisco | Firepower 4120 Next-Generation Firewall | - |
| Cisco | Firepower 4140 Next-Generation Firewall | - |
| Cisco | Firepower 4150 Next-Generation Firewall | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/101652Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039719Third Party AdvisoryVDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
- http://www.securityfocus.com/bid/101652Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039719Third Party AdvisoryVDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
FAQ
What is CVE-2017-12243?
CVE-2017-12243 is a vulnerability with a CVSS score of 7.8 (HIGH). A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticat...
How severe is CVE-2017-12243?
CVE-2017-12243 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-12243?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Unified Computing System Manager Firmware, Cisco Unified Computing System Manager, Cisco Firepower 9300 Security Appliance Firmware, Cisco Firepower 9300 Security Appliance, Cisco Firepower 4100 Next-Generation Firewall Firmware.