CVE-2017-3873

CVE	CVE-2017-3873
State	PUBLISHED
Assigner	cisco
Source Priority	CVE Program / NVD first with legacy fallback
Published	2017-05-16 17:29:00 UTC
Updated	2025-04-20 01:37:25 UTC
Description	A vulnerability in the Plug-and-Play (PnP) subsystem of the Cisco Aironet 1800, 2800, and 3800 Series Access Points running a Lightweight Access Point (AP) or Mobility Express image could allow an unauthenticated, adjacent attacker to execute arbitrary code with root privileges. The vulnerability is due to insufficient validation of PnP server responses. The PnP feature is only active while the device does not contain a configuration, such as a first time boot or after a factory reset has been issued. An attacker with the ability to respond to PnP configuration requests from the affected device can exploit the vulnerability by returning malicious PnP responses. If a Cisco Application Policy Infrastructure Controller - Enterprise Module (APIC-EM) is available on the network, the attacker would need to exploit the issue in the short window before a valid PnP response was received. If successful, the attacker could gain the ability to execute arbitrary code with root privileges on the underlying operating system of the device. Cisco has confirmed that the only vulnerable software version is 8.3.102.0. Cisco Bug IDs: CSCvb42386.

Primary CVSS: v3.0 7.5 HIGH from [email protected]

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-20 | CWE-20 CWE-20

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	7.5	HIGH	`CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
2.0	[email protected]	Primary	7.9		`AV:A/AC:M/Au:N/C:C/I:C/A:C`

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Access Vector

Adjacent

Access Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:A/AC:M/Au:N/C:C/I:C/A:C

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Cisco	Aironet 1830e	-	All	All	All
Hardware	Cisco	Aironet 1830i	-	All	All	All
Hardware	Cisco	Aironet 1850e	-	All	All	All
Hardware	Cisco	Aironet 1850i	-	All	All	All
Hardware	Cisco	Aironet 2800e	-	All	All	All
Hardware	Cisco	Aironet 2800i	-	All	All	All
Hardware	Cisco	Aironet 3800e	-	All	All	All
Hardware	Cisco	Aironet 3800i	-	All	All	All
Hardware	Cisco	Aironet 3800p	-	All	All	All
Operating System	Cisco	Aironet Access Point Firmware	8.3_102.0	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	Cisco Aironet 1800 2800 And 3800 Series Access Points	affected Cisco Aironet 1800, 2800, and 3800 Series Access Points	Not specified

Reference	Source	Link	Tags
Cisco Aironet Access Points CVE-2017-3873 Arbitrary Code Execution Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Third Party Advisory, VDB Entry
Cisco Aironet 1800, 2800, and 3800 Series Access Points Plug-and-Play Arbitrary Code Execution Vulnerability	af854a3a-2127-422b-91ae-364da2661108	tools.cisco.com	Vendor Advisory
Cisco Aironet PnP Reponse Processing Flaw Lets Remote Users Execute Arbitrary Code on the Target System - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.