PT-2017-12418 · Cisco · Cisco Ios Xe+2

Published 2017-09-27 · Updated 2019-10-09 · CVE-2017-12228

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.4 through 15.6 Cisco IOS XE versions 3.3 through 16.4

Description A vulnerability in the Cisco Network Plug and Play application could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.

Recommendations For Cisco IOS versions 12.4 through 15.6, update to a fixed software version. For Cisco IOS XE versions 3.3 through 16.4, update to a fixed software version. As a general mitigation measure, ensure that all software updates are applied as soon as they become available, and consider implementing additional security measures to detect and prevent man-in-the-middle attacks.

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-20

CWE-295

Related Identifiers

CVE-2017-12228

Affected Products

Cisco Ios

Cisco Ios Xe

Cisco Network Plug/Play

References · 5

• https://osv.dev/vulnerability/CVE-2017-12228 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-pnp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12228 · Security Note
• http://securityfocus.com/bid/101065 · Note
• http://securitytracker.com/id/1039450 · Note