CVE-2017-12351
published 2017-11-30CVE-2017-12351: A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the…
PriorityP425medium5.7CVSS 3.0
AVLACLPRHUINSCCLILAL
EPSS
0.34%
27.1th percentile
A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the scope of the guest shell container. An attacker would need valid administrator credentials to perform this attack. The vulnerability is due to insufficient internal security measures in the guest shell feature. An attacker could exploit this vulnerability by sending or receiving packets on the device-internal network outside of the guest shell container, aka "Unauthorized Internal Interface Access." This vulnerability affects the following products running Cisco NX-OS System Software: Nexus 3000 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvf33038.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os_system | — | — |
CVSS provenance
nvdv3.05.7MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_cisco5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p85m-8mw3-j4v4: A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outsid
ghsa_unreviewed·2022-05-13
CVE-2017-12351 [MEDIUM] CWE-668 GHSA-p85m-8mw3-j4v4: A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outsid
A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the scope of the guest shell container. An attacker would need valid administrator credentials to perform this attack. The vulnerability is due to insufficient internal security measures in the guest shell feature. An attacker could exploit this vulnerability by sending or receiving packets on the device-internal network outside of the guest shell container, aka "Unauthorized Internal Interface Access." This vulnerability affects the following products running Cisco NX-OS System Software: Nexus 3000 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvf33
Cisco
Cisco NX-OS System Software Guest Shell Unauthorized Internal Interface Access Vulnerability
vendor_cisco·2017-11-29·CVSS 5.7
CVE-2017-12351 [MEDIUM] CWE-264 Cisco NX-OS System Software Guest Shell Unauthorized Internal Interface Access Vulnerability
Cisco NX-OS System Software Guest Shell Unauthorized Internal Interface Access Vulnerability
A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the scope of the guest shell container. An attacker would need valid administrator credentials to perform this attack.
The vulnerability is due to insufficient internal security measures in the guest shell feature. An attacker could exploit this vulnerability by sending or receiving packets on the device-internal network outside of the guest shell container.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisc
Cisco
Cisco NX-OS System Software Guest Shell Unauthorized Internal Interface Access Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-12351 Cisco NX-OS System Software Guest Shell Unauthorized Internal Interface Access Vulnerability
CVE-2017-12351: Cisco NX-OS System Software Guest Shell Unauthorized Internal Interface Access Vulnerability
A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the scope of the guest shell container. An attacker would need valid administrator credentials to perform this attack. The vulnerability is due to insufficient internal security measures in the guest shell feature. An attacker could exploit this vulnerability by sending or receiving packets on the device-internal network outside of the guest shell container. There are no
CVSS: 3.0
CWE: CWE-264, CWE-264
Bug IDs: CSCvf33038
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/102019http://www.securitytracker.com/id/1039932https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos10http://www.securityfocus.com/bid/102019http://www.securitytracker.com/id/1039932https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos10
2017-11-30
Published