CVE Feed

    Dashboard / CVE / CVE-2017-12332

    CVE-2017-12332

    A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vulnerability is due to insufficient restrictions in the patch installation process. An attacker could exploit this vulnerability by installing a crafted patch image on an affected device. The vulnerable operation occurs prior to patch activation. An exploit could allow the attacker to write arbitrary files on an affected system as root. The attacker would need valid administrator credentials to perform this exploit. This vulnerability affects the following products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Fabric Extenders, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Unified Computing System Manager. Cisco Bug IDs: CSCvf16513, CSCvf23794, CSCvf23832.

    Published:Nov 30, 2017
    Last Modified:Apr 20, 2025
    EPS:Nov 30, 2017
    EPSS Score:0.00084
    CVSS Score:4.4

    Affected Products

    Vendor
    Cisco
    Product
    Nx-os
    Vendor
    Cisco
    Product
    Unified Computing System

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2025-20241 (CVSS 7.4) — A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of Cisco NX-OS Software for …
    CVE-2025-20262 (CVSS 5) — A vulnerability in the Protocol Independent Multicast Version 6 (PIM6) feature of Cisco Nexus 3000 Series Swit…
    CVE-2025-20290 (CVSS 5.5) — A vulnerability in the logging feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches, Cisco Nex…
    CVE-2025-20292 (CVSS 4.4) — A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a c…
    CVE-2024-20284 (CVSS 5.3) — A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged…
    CVE-2024-20285 (CVSS 5.3) — A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged…
    CVE-2024-20286 (CVSS 5.3) — A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged…
    CVE-2024-20446 (CVSS 8.6) — A vulnerability in the DHCPv6 relay agent of Cisco NX-OS Software could allow an unauthenticated, remote attac…
    CVE-2024-20411 (CVSS 6.7) — A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access…
    CVE-2024-20413 (CVSS 6.7) — A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High