Privilege escalation in Cisco Emergency Responder - CVE-2017-12337

Vulnerability identifier: #VU9387

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-12337

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists in Cisco Voice Operating System (VOS) software platform device due to improper authentication when a refresh upgrade or Prime Collaboration Deployment (PCD) migration is performed. A remote attacker can gain root access to the device with a known password and compromise the affected system.

Cisco Emergency Responder
Cisco MediaSense
Cisco Hosted Collaboration
Cisco Finesse
Unified Communications Manager (CallManager)
Cisco Unity Connection
Customer Collaboration Platform (CCP)
Cisco Unified Intelligence Center

The vulnerability is addressed in the following versions: CER.12.0(1.11900.5), CER.11.5(4.20000.2).

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-vos

• Privilege escalation in Cisco Emergency Responder
• Privilege escalation in Cisco Unity Connection
• Privilege escalation in Cisco Finesse
• Privilege escalation in Cisco Unified Communications Manager
• Privilege escalation in Cisco MediaSense
• Privilege escalation in Cisco Unified Intelligence Center
• Privilege escalation in Cisco SocialMiner
• Privilege escalation in Cisco Hosted Collaboration