What is CVE-2017-12226?

CVE-2017-12226 is a high-severity vulnerability in Cisco iOS Xe, classified under CWE-264. CVSS score: 8.8/10. Published 2017-09-29.

How severe is CVE-2017-12226?

High severity. CVSS v3 base score is 8.8 out of 10.

Improper input validation in Cisco iOS Xe

CVE-2017-12226

A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, and Cisco New Generation Wireless Controllers (NGWC) 3850 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incomplete input validation of HTTP requests by the affected GUI, if the GUI connection state or protocol changes. An attacker could exploit this vulnerability by authenticating to the Wireless Controller GUI as a Lobby Administrator user of an affected device and subsequently changing the state or protocol for their connection to the GUI. A successful exploit could allow the attacker to elevate their privilege level to administrator and gain full control of the affected device. This vulnerability affects the following Cisco products if they are running Cisco IOS XE Software Release 3.7.0E, 3.7.1E, 3.7.2E, 3.7.3E, 3.7.4E, or 3.7.5E: Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, Cisco New Generation Wireless Controllers (NGWC) 3850. Cisco Bug IDs: CSCvd73746.

Published 2017-09-29 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.033 (88.0th percentile), scored 2026-10-03.

Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.033 · newest: 0.033 · change: 0.000

Affected products

Cisco iOS Xe — versions 3.7.0e, 3.7.1e, 3.7.2e
Cisco iOS Xe — versions Cisco IOS XE

Weakness classification (CWE)

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927… (Vendor Advisory)
www.securitytracker.com/id/1039456 (VDB Entry, Third Party Advisory, vdb-entry)
www.securitytracker.com/id/1039457 (VDB Entry, Third Party Advisory, vdb-entry)
www.securityfocus.com/bid/101063 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2017-12226?: CVE-2017-12226 is a high-severity vulnerability in Cisco iOS Xe, classified under CWE-264. CVSS score: 8.8/10. Published 2017-09-29.
How severe is CVE-2017-12226?: High severity. CVSS v3 base score is 8.8 out of 10.