CVE-2017-12243

🗓️ 02 Nov 2017 16:00:00Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 59 Views🌐 WEB

A vulnerability in the Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 could allow authenticated local attacker to obtain root shell privileges on the device, aka Command Injection

Reporter	Title	Published	Views	Family All 8
Cisco	Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance Command Injection Vulnerability	1 Nov 201716:00	–	cisco
CNVD	Command Injection Vulnerability in Multiple Cisco Products	2 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-12243	2 Nov 201716:00	–	cvelist
Exploit DB	Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution	1 Nov 201700:00	–	exploitdb
exploitpack	Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution	1 Nov 201700:00	–	exploitpack
NVD	CVE-2017-12243	2 Nov 201716:29	–	nvd
Prion	Command injection	2 Nov 201716:29	–	prion
seebug.org	Cisco UCS Platform Emulator Remote Code Execution	1 Nov 201700:00	–	seebug

NVD

Node

cisco unified_computing_system_manager_firmwareMatch-

AND

cisco unified_computing_system_managerMatch-

Node

cisco firepower_9300_security_appliance_firmwareMatch-

AND

cisco firepower_9300_security_applianceMatch-

Node

cisco firepower_4100_next-generation_firewall_firmwareMatch-

AND

cisco firepower_4110_next-generation_firewallMatch-

cisco firepower_4120_next-generation_firewallMatch-

cisco firepower_4140_next-generation_firewallMatch-

cisco firepower_4150_next-generation_firewallMatch-

[
  {
    "product": "Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-arce
securitytracker	www.securitytracker.com/id/1039719
securityfocus	www.securityfocus.com/bid/101652

Parameter	Position	Path	Description	CWE
ping_num	query param	settings/ping	Unauthenticated remote command injection via ping endpoint parameters.	CWE-78
ping_ip_addr	query param	settings/ping	Unauthenticated remote command injection via ping endpoint parameters.	CWE-78

13 May 2026 00:24Current

7.4High risk

Vulners AI Score7.4

CVSS 27.2

CVSS 37.8

EPSS0.4022

CWE-78