CVE-2017-12331: High severity cisco nx-os vulnerability
A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software patch. The vulnerability is due to insufficient NX-OS signature verification for software patches. An authenticated, local attacker could exploit this vulnerability to bypass signature verification and load a crafted, unsigned software patch on a targeted device. The attacker would need valid administrator credentials to perform this exploit. This vulnerability affects the following products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Unified Computing System Manager. Cisco Bug IDs: CSCvf16494, CSCvf23655.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-12331?
CVE-2017-12331 is a vulnerability in Cisco NX-OS System Software that allows an authenticated local attacker to bypass signature verification when loading a software patch.
What is the severity of CVE-2017-12331?
The severity of CVE-2017-12331 is high with a severity value of 6.7.
How can an attacker exploit CVE-2017-12331?
An authenticated, local attacker could exploit CVE-2017-12331 by bypassing signature verification for software patches in Cisco NX-OS System Software.
Which software versions are affected by CVE-2017-12331?
Cisco NX-OS version 8.1(1) and Cisco Unified Computing System version 7.0(0)hsk(0.357) are affected by CVE-2017-12331.
How can I fix CVE-2017-12331?
To fix CVE-2017-12331, Cisco has released a security advisory with recommended updates and patches. Please refer to the Cisco Security Advisory for specific instructions.