CVE-2017-12329

Summary

CVE	CVE-2017-12329
State	PUBLISHED
Assigner	cisco
Source Priority	CVE Program / NVD first with legacy fallback
Published	2017-11-30 09:29:00 UTC
Updated	2025-04-20 01:37:25 UTC
Description	A vulnerability in the CLI of Cisco Firepower Extensible Operating System (FXOS) and NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command. An exploit could allow the attacker to execute arbitrary commands at the user's privilege level. On products that support multiple virtual device contexts (VDCs), this vulnerability could allow the attacker to execute commands at the user's privilege level outside the user's environment. This vulnerability affects the following products running Cisco FXOS or NX-OS System Software: Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, Multilayer Director Switches, Nexus 1000V Series Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, Unified Computing System Manager. Cisco Bug IDs: CSCve51700, CSCve93833, CSCve93860, CSCve93863, CSCve93864, CSCve93880.

Risk And Classification

Primary CVSS: v3.0 6.3 MEDIUM from [email protected]

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS: 0.004930000 probability, percentile 0.658450000 (date 2026-05-14)

Problem Types: CWE-77 | CWE-77 CWE-77

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	6.3	MEDIUM	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L`
2.0	[email protected]	Primary	4.6		`AV:L/AC:L/Au:N/C:P/I:P/A:P`

CVSS v3.0 Breakdown

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CVSS v2.0 Breakdown

Access Vector

Local

Access Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

AV:L/AC:L/Au:N/C:P/I:P/A:P

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Cisco	Firepower Extensible Operating System	-	All	All	All
Operating System	Cisco	Nx-os	5.2\(1\)sv3\(2.8\)	All	All	All
Operating System	Cisco	Nx-os	8.0\(1\)	All	All	All
Operating System	Cisco	Nx-os	8.1\(0.2\)s0	All	All	All
Operating System	Cisco	Nx-os	8.1\(0\)bd\(0.20\)	All	All	All
Application	Cisco	Unified Computing System	7.0\(0\)hsk\(0.357\)	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	Cisco FXOS And NX-OS	affected Cisco FXOS and NX-OS	Not specified

References

Reference	Source	Link	Tags
Cisco FXOS and NX-OS System Software CLI Command Injection Vulnerability	af854a3a-2127-422b-91ae-364da2661108	tools.cisco.com	Vendor Advisory
Cisco NX-OS CLI Input Validation Flaw Lets Local Users Gain Elevated Privileges - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com	Third Party Advisory, VDB Entry
Cisco FXOS and NX-OS System Software CVE-2017-12329 Local Command Injection Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Third Party Advisory, VDB Entry
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.