CVE-2017-12250: Input Validation
First published: Thu Sep 21 2017(Updated: )
A vulnerability in the HTTP web interface for Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause an HTTP Application Optimization (AO) related process to restart, causing a partial denial of service (DoS) condition. The vulnerability is due to lack of input validation of user-supplied input parameters within an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request through the targeted device. An exploit could allow the attacker to cause a DoS condition due to a process unexpectedly restarting. The WAAS could drop traffic during the brief time the process is restarting. Cisco Bug IDs: CSCvc63048.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Wide Area Application Services | =6.2\(3a\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-12250?
CVE-2017-12250 has a severity rating of medium and could lead to a partial denial of service for affected systems.
How do I fix CVE-2017-12250?
To remediate CVE-2017-12250, upgrade Cisco Wide Area Application Services to a version that addresses the vulnerability.
What software is affected by CVE-2017-12250?
CVE-2017-12250 specifically affects Cisco Wide Area Application Services version 6.2(3a).
Can CVE-2017-12250 be exploited remotely?
Yes, CVE-2017-12250 can be exploited by unauthenticated remote attackers.
What impact does CVE-2017-12250 have on systems?
CVE-2017-12250 can cause an HTTP Application Optimization process to restart, resulting in a partial denial of service condition.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/cisco
- canonical/cisco wide area application services
- version/cisco wide area application services/6.2\(3a\)