// For flags

CVE-2017-12338

 

Severity Score

6.0
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerability is due to insufficient input validation for a specific CLI command. An attacker could exploit this vulnerability by issuing a crafted command on the CLI. An exploit could allow the attacker unauthorized access to read arbitrary files on the underlying local file system. On products that support multiple virtual device contexts (VDCs), this vulnerability could allow an attacker to read files from any VDC. This vulnerability affects the following products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode, Nexus 9000 Series Switches in standalone NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules, Unified Computing System Manager. Cisco Bug IDs: CSCve51707, CSCve93961, CSCve93964, CSCve93965, CSCve93968, CSCve93974, CSCve93976.

Una vulnerabilidad en la interfaz de línea de comandos de NX-OS System Software podría permitir que un atacante local autenticado lea los contenidos de archivos arbitrarios. La vulnerabilidad se debe a una validación de entradas insuficiente para un comando específico de la interfaz de línea de comandos. Un atacante podría explotar esta vulnerabilidad enviando un comando manipulado en la interfaz de línea de comandos. El atacante podría utilizar un exploit para acceder de manera no autorizada para leer archivos arbitrarios en el sistema de archivos local subyacente. En productos que son compatibles con múltiples contextos de dispositivos virtuales (VDC), esta vulnerabilidad podría permitir que un atacante lea archivos desde cualquier VDC. Esta vulnerabilidad afecta a los siguientes productos que ejecutan Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Fabric Switches en modo Application Centric Infrastructure (ACI), Nexus 9000 Series Switches en modo standalone NX-OS, Nexus 9500 R-Series Line Cards and Fabric Modules y Unified Computing System Manager. Cisco Bug IDs: CSCve51707, CSCve93961, CSCve93964, CSCve93965, CSCve93968, CSCve93974, CSCve93976.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-08-03 CVE Reserved
  • 2017-11-30 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Nx-os
Search vendor "Cisco" for product "Nx-os"
 8.0\(1\)
Search vendor "Cisco" for product "Nx-os" and version "8.0\(1\)"
-
Affected
Cisco
Search vendor "Cisco"
 Nx-os
Search vendor "Cisco" for product "Nx-os"
 8.1\(0\)bd\(0.20\)
Search vendor "Cisco" for product "Nx-os" and version "8.1\(0\)bd\(0.20\)"
-
Affected
Cisco
Search vendor "Cisco"
 Nx-os
Search vendor "Cisco" for product "Nx-os"
 8.1\(1\)
Search vendor "Cisco" for product "Nx-os" and version "8.1\(1\)"
-
Affected
Cisco
Search vendor "Cisco"
 Unified Computing System
Search vendor "Cisco" for product "Unified Computing System"
 7.0\(0\)hsk\(0.357\)
Search vendor "Cisco" for product "Unified Computing System" and version "7.0\(0\)hsk\(0.357\)"
-
Affected
Cisco
Search vendor "Cisco"
 Lan Switch Software
Search vendor "Cisco" for product "Lan Switch Software"
 12.2\(1.107\)
Search vendor "Cisco" for product "Lan Switch Software" and version "12.2\(1.107\)"
-
Affected