CVE-2017-12255
published 2017-09-21CVE-2017-12255: A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access. The vulnerability is due to…
PriorityP429medium6.7CVSS 3.0
AVLACLPRHUINSUCHIHAH
EPSS
0.43%
34.8th percentile
A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access. The vulnerability is due to insufficient input validation of commands entered in the CLI, aka a Restricted Shell Break Vulnerability. An attacker could exploit this vulnerability by entering a specific command with crafted arguments. An exploit could allow the attacker to gain shell access to the underlying system. Cisco Bug IDs: CSCve70762.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ucs_central | — | — |
| cisco | unified_computing_system | — | — |
CVSS provenance
nvdv3.06.7MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gg94-88qg-53xh: A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access
ghsa_unreviewed·2022-05-13
CVE-2017-12255 [HIGH] CWE-20 GHSA-gg94-88qg-53xh: A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access
A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access. The vulnerability is due to insufficient input validation of commands entered in the CLI, aka a Restricted Shell Break Vulnerability. An attacker could exploit this vulnerability by entering a specific command with crafted arguments. An exploit could allow the attacker to gain shell access to the underlying system. Cisco Bug IDs: CSCve70762.
Cisco
Cisco UCS Central Software Command Line Interface Restricted Shell Break Vulnerability
vendor_cisco·2017-09-20·CVSS 6.7
CVE-2017-12255 [MEDIUM] CWE-20 Cisco UCS Central Software Command Line Interface Restricted Shell Break Vulnerability
Cisco UCS Central Software Command Line Interface Restricted Shell Break Vulnerability
A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access.
The vulnerability is due to insufficient input validation of commands entered in the CLI. An attacker could exploit this vulnerability by entering a specific command with crafted arguments. An exploit could allow the attacker to gain shell access to the underlying system.
There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-ucs
Cisco
Cisco UCS Central Software Command Line Interface Restricted Shell Break Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-12255 Cisco UCS Central Software Command Line Interface Restricted Shell Break Vulnerability
CVE-2017-12255: Cisco UCS Central Software Command Line Interface Restricted Shell Break Vulnerability
A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access. The vulnerability is due to insufficient input validation of commands entered in the CLI. An attacker could exploit this vulnerability by entering a specific command with crafted arguments. An exploit could allow the attacker to gain shell access to the underlying system. There are no
CVSS: 3.0
CWE: CWE-20, CWE-20
Bug IDs: CSCve70762
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/100932http://www.securitytracker.com/id/1039412https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-ucshttp://www.securityfocus.com/bid/100932http://www.securitytracker.com/id/1039412https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-ucs
2017-09-21
Published