$ cve CVE-2017-12243 JSON

CVE-2017-12243 EXPLOIT

7.8

HIGH · CVSS 3.0 · EPSS 77.1% (pctl 100)

Patch early

A public exploit exists.

Description

A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to obtain root shell privileges on the device, aka Command Injection. The vulnerability is due to improper validation of string input in the shell application. An attacker could exploit this vulnerability through the use of malicious commands. A successful exploit could allow the attacker to obtain root shell privileges on the device. Cisco Bug IDs: CSCvf20741, CSCvf60078.

Scoring

CVSS	7.8 (HIGH, v3.0)
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	77.07% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-78
On CISA KEV	no
Public exploit	yes
Published	2017-11-02
Last modified	2026-06-17

Affected (9)

Vendor	Product
cisco	firepower 4100 next-generation firewall firmware
cisco	firepower 4110 next-generation firewall
cisco	firepower 4120 next-generation firewall
cisco	firepower 4140 next-generation firewall
cisco	firepower 4150 next-generation firewall
cisco	firepower 9300 security appliance
cisco	firepower 9300 security appliance firmware
cisco	unified computing system manager
cisco	unified computing system manager firmware

Public exploits

Source	Title	Date
exploit-db	Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution	2017-11-01

References

→ the Explorer · watch your stack · NVD