Cisco NX-OS Improper Input Validation (CVE-2017-12336)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502717);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/16");

  script_cve_id("CVE-2017-12336");

  script_name(english:"Cisco NX-OS Improper Input Validation (CVE-2017-12336)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the TCL scripting subsystem of Cisco NX-OS System
Software could allow an authenticated, local attacker to escape the
interactive TCL shell and gain unauthorized access to the underlying
operating system of the device. The vulnerability exists due to
insufficient input validation of user-supplied files passed to the
interactive TCL shell of the affected device. An attacker could
exploit this vulnerability to escape the scripting sandbox and execute
arbitrary commands on the underlying operating system with the
privileges of the authenticated user. To exploit this vulnerability,
an attacker must have local access and be authenticated to the
targeted device with administrative or tclsh execution privileges.
This vulnerability affects the following products running Cisco NX-OS
System Software: Multilayer Director Switches, Nexus 2000 Series
Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform
Switches, Nexus 5000 Series Switches, Nexus 5500 Platform Switches,
Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000
Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series
Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and
Fabric Modules, Unified Computing System Manager. Cisco Bug IDs:
CSCve93750, CSCve93762, CSCve93763, CSCvg04127.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/102168");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1039936");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?775f3b80");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/102168");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1039936");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?775f3b80");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12336");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_3000_series_switches");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_5000_series_switches");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_7000_series_switches");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nexus_3000_series_switches" :
        {"versionEndIncluding" : "6.0%282%29A8%283%29", "versionStartIncluding" : "6.0%282%29A8%283%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_5000_series_switches" :
        {"versionEndExcluding" : "7.3%283%29N1%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_7000_series_switches" :
        {"versionEndIncluding" : "8.0%281%29", "versionStartIncluding" : "8.0%281%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);