Security restrictions bypass in Cisco Systems, Inc products - CVE-2017-12332
Published: December 1, 2017
Vulnerability identifier: #VU9491
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12332
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to bypass security restrictions on the target system.
The weakness exists in Cisco NX-OS System Software due to insufficient restrictions in the patch installation process. A local attacker with knowledge of valid administrator credentials can install a specially crafted patch image, bypass security restrictions and write a file to arbitrary locations.
The weakness exists in Cisco NX-OS System Software due to insufficient restrictions in the patch installation process. A local attacker with knowledge of valid administrator credentials can install a specially crafted patch image, bypass security restrictions and write a file to arbitrary locations.
Affected software
Nexus 7700 Series Switches
Nexus 7000 Series Switches
Nexus 6000 Series Switches
Nexus 5600 Platform Switches
Nexus 5500 Platform Switches
Nexus 5000 Series Switches
Nexus 2000 Series Fabric Extenders
Multilayer Director Switches
Nexus 7000 Series Switches
Nexus 6000 Series Switches
Nexus 5600 Platform Switches
Nexus 5500 Platform Switches
Nexus 5000 Series Switches
Nexus 2000 Series Fabric Extenders
Multilayer Director Switches
How to mitigate CVE-2017-12332
Install update from vendor's website.