CVE-2017-12341: Command Injection
First published: Thu Nov 30 2017(Updated: )
A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would need valid administrator credentials to perform this exploit. The vulnerability is due to insufficient input validation during the installation of a software patch. An attacker could exploit this vulnerability by installing a crafted patch image with the vulnerable operation occurring prior to patch activation. An exploit could allow the attacker to execute arbitrary commands on an affected system as root. This vulnerability affects the following products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Fabric Extenders, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Unified Computing System Manager. Cisco Bug IDs: CSCvf23735, CSCvg04072.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Computing System | =7.0\(0\)hsk\(0.357\) | |
| Cisco Nx-os | =8.1\(0.59\)s0 | |
| Cisco Nx-os | =8.1\(1\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco NX-OS System Software vulnerability?
The vulnerability ID for this Cisco NX-OS System Software vulnerability is CVE-2017-12341.
What is the severity of CVE-2017-12341?
The severity of CVE-2017-12341 is high.
What is the affected software for CVE-2017-12341?
The affected software for CVE-2017-12341 includes Cisco Unified Computing System 7.0(0)hsk(0.357), Cisco Nx-os 8.1(0.59)s0, and Cisco Nx-os 8.1(1).
What is the vulnerability description of CVE-2017-12341?
CVE-2017-12341 is a vulnerability in the CLI of Cisco NX-OS System Software that could allow an authenticated, local attacker to perform a command injection attack.
How can this vulnerability be exploited?
To exploit CVE-2017-12341, an attacker would need valid administrator credentials and can perform a command injection attack.
- collector/nvd-index
- agent/author
- agent/references
- agent/weakness
- agent/severity
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/cisco
- canonical/cisco unified computing system
- version/cisco unified computing system/7.0\(0\)hsk\(0.357\)
- canonical/cisco nx-os
- version/cisco nx-os/8.1\(0.59\)s0
- version/cisco nx-os/8.1\(1\)