Privilege escalation in Cisco Unified Computing System Manager

Published: 2017-11-02 12:04:02 | Updated: 2017-11-02 12:05:54
Severity Low
Patch available NO
Number of vulnerabilities 1
CVSSv2 3.4 (AV:L/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
CVSSv3 6.7 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE ID CVE-2017-12243
CWE ID CWE-20
Exploitation vector Local
Public exploit Not available
Vulnerable software Cisco Unified Computing System Manager
Cisco Firepower 4100 Series Next-Generation Firewall
Cisco Firepower 9300 Security Appliance
Vulnerable software versions Cisco Unified Computing System Manager 3.1(1k)A
Cisco Firepower 4100 Series Next-Generation Firewall -
Cisco Firepower 9300 Security Appliance -
Vendor URL Cisco Systems, Inc
Advisory type Public

Security Advisory

1) Privilege escalation

Description

The vulnerability allows a local attacker to gain elevated privileges on the target device.

The weakness exists in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance is due to improper validation of string input in the shell application. A local attacker can use malicious commands to obtain root shell privileges on the device.

Remediation

Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-arce

Back to List