RCE in Cisco Firepower 4100 Next-Generation Firewall Firmware
CVE-2017-12243
A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to obtain root shell privileges on the device, aka Command Injection. The vulnerability is due to improper validation of string input in the shell application. An attacker could exploit this vulnerability through the use of malicious commands. A successful exploit could allow the attacker to obtain root shell privileges on the device. Cisco Bug IDs: CSCvf20741, CSCvf60078.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.771 (99.6th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.771 · newest: 0.771 · change: 0.000
Affected products
- Cisco Firepower 4100 Next-Generation Firewall Firmware
- Cisco Firepower 4110 Next-Generation Firewall
- Cisco Firepower 4120 Next-Generation Firewall
- Cisco Firepower 4140 Next-Generation Firewall
- Cisco Firepower 4150 Next-Generation Firewall
- Cisco Firepower 9300 Security Appliance
- Cisco Firepower 9300 Security Appliance Firmware
- Cisco Unified Computing System Manager
- Cisco Unified Computing System Manager Firmware
- Cisco Ucs Manager, Firepower 4100 Series Ngfw, And 9300 Security Appliance — versions Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/101652 (VDB Entry, Third Party Advisory, vdb-entry)
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101… (Vendor Advisory)
- www.securitytracker.com/id/1039719 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2017-12243?
- CVE-2017-12243 is a high-severity vulnerability in Cisco Firepower 4100 Next-Generation Firewall Firmware, classified under OS Command Injection. CVSS score: 7.8/10. Published 2017-11-02.
- How severe is CVE-2017-12243?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2017-12243 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.