Multiple Cisco Products CVE-2017-12243 Local Command Injection Vulnerability

Bugtraq ID:	101652
Class:	Input Validation Error
CVE:	CVE-2017-12243
Remote:	No
Local:	Yes
Published:	Nov 01 2017 12:00AM
Updated:	Dec 19 2017 09:00PM
Credit:	Cisco.
Vulnerable:	Cisco Unified Computing System Manager 0 Cisco Unified Computing System 3.1(1k)A Cisco Firepower 9300 Security Appliance 0 Cisco Firepower 9000 Series 1.1(3.52) Cisco Firepower 4100 Series Next-Generation Firewall 0
Not Vulnerable:	Cisco Unified Computing System 3.2(2b) Cisco Unified Computing System 3.2(1d) Cisco Firepower 9000 Series 92.3(1.2259)

Multiple Cisco Products CVE-2017-12243 Local Command Injection Vulnerability

Multiple Cisco Products are prone to a local command-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. .

This issue is being tracked by Cisco bug ID CSCvf20741 and CSCvf60078.

Multiple Cisco Products CVE-2017-12243 Local Command Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Multiple Cisco Products CVE-2017-12243 Local Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Cisco Products CVE-2017-12243 Local Command Injection Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Se (Cisco)