Command Injection Vulnerability in Cisco Unified Computing System and Firepower Devices
CVE-2017-12243

7.8HIGH

Key Information:

Vendor: Cisco
Status: Cisco Ucs Manager, Cisco Firepower 4100 Series Ngfw, And Cisco Firepower 9300 Security Appliance
Vendor: CVE Published:; 2 November 2017

Summary

A command injection vulnerability exists in Cisco Unified Computing System (UCS) Manager and Cisco Firepower devices, allowing authenticated local attackers to execute arbitrary commands. This flaw arises from inadequate validation of string inputs in the shell application. By crafting and sending malicious commands, an attacker can potentially gain root shell privileges on the affected devices, leading to unauthorized access and control over system functions.

Affected Version(s)

Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance