Improper input validation in Cisco Unified Computing System
CVE-2017-12255
A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access. The vulnerability is due to insufficient input validation of commands entered in the CLI, aka a Restricted Shell Break Vulnerability. An attacker could exploit this vulnerability by entering a specific command with crafted arguments. An exploit could allow the attacker to gain shell access to the underlying system. Cisco Bug IDs: CSCve70762.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (34.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 34.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Cisco Unified Computing System — versions 1.5\(1c\), 1.5(1c)
- Cisco Ucs Central Software — versions Cisco UCS Central Software
Weakness classification (CWE)
References
- www.securityfocus.com/bid/100932 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securitytracker.com/id/1039412 (VDB Entry, Third Party Advisory, vdb-entry)
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920… (Vendor Advisory)
Frequently asked questions
- What is CVE-2017-12255?
- CVE-2017-12255 is a medium-severity vulnerability in Cisco Unified Computing System, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2017-09-21.
- How severe is CVE-2017-12255?
- Medium severity. CVSS v3 base score is 6.7 out of 10.