CVE-2017-12243

🗓️ 02 Nov 2017 16:00:00Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 60 Views🌐 WEB

A vulnerability in the Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 could allow authenticated local attacker to obtain root shell privileges on the device, aka Command Injection

Reporter	Title	Published	Views	Family All 9
BDU FSTEC	The vulnerability of the Cisco Unified Computing System (UCS) Manager, the microsoftware-based network interface card of the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and the Cisco Firepower 9300 Security Appliance allows a attacker to gain access to the device with root privileges.	15 Feb 201800:00	–	bdu_fstec
Cisco	Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance Command Injection Vulnerability	1 Nov 201716:00	–	cisco
CNVD	Command Injection Vulnerability in Multiple Cisco Products	2 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-12243	2 Nov 201716:00	–	cvelist
Exploit DB	Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution	1 Nov 201700:00	–	exploitdb
exploitpack	Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution	1 Nov 201700:00	–	exploitpack
NVD	CVE-2017-12243	2 Nov 201716:29	–	nvd
Prion	Command injection	2 Nov 201716:29	–	prion
seebug.org	Cisco UCS Platform Emulator Remote Code Execution	1 Nov 201700:00	–	seebug

NVD

Node

cisco unified_computing_system_manager_firmwareMatch-

AND

cisco unified_computing_system_managerMatch-

Node

cisco firepower_9300_security_appliance_firmwareMatch-

AND

cisco firepower_9300_security_applianceMatch-

Node

cisco firepower_4100_next-generation_firewall_firmwareMatch-

AND

cisco firepower_4110_next-generation_firewallMatch-

cisco firepower_4120_next-generation_firewallMatch-

cisco firepower_4140_next-generation_firewallMatch-

cisco firepower_4150_next-generation_firewallMatch-

[
  {
    "product": "Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-arce
securitytracker	www.securitytracker.com/id/1039719
securityfocus	www.securityfocus.com/bid/101652

Parameter	Position	Path	Description	CWE
ping_num	query param	/settings/ping	Unauthenticated remote code execution via unsanitized input in ping command. Commands injected through ping_num/ping_ip_addr cause root execution on the remote device.	CWE-78
ping_ip_addr	query param	/settings/ping	Unauthenticated remote code execution via unsanitized input in ping command. Commands injected through ping_num/ping_ip_addr cause root execution on the remote device.	CWE-78

17 Jun 2026 01:02Current

7.4High risk

Vulners AI Score7.4

CVSS 27.2

CVSS 37.8

EPSS0.77071

CWE-78