PT-2017-12437 · Cisco · Cisco Application Policy Infrastructure Controller Enterprise Module

Published 2017-11-02 · Updated 2019-10-09 · CVE-2017-12262

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller Enterprise Module versions prior to 1.5

Description A misconfiguration in the firewall configuration could allow an unauthenticated, adjacent attacker to gain privileged access to services on the internal network of the device. This is due to an incorrect firewall rule that could forward traffic from the public interface to the internal virtual network. An attacker logically adjacent to the network could leverage this to gain access to internal services with elevated privileges.

Recommendations For versions prior to 1.5, update to version 1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the public interface of the affected device to minimize the risk of exploitation.

Fix

Improper Access Control

Improper Initialization

Weakness Enumeration

CWE-284

CWE-665

Related Identifiers

CVE-2017-12262

Affected Products

Cisco Application Policy Infrastructure Controller Enterprise Module

References · 5

• https://osv.dev/vulnerability/CVE-2017-12262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12262 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-apicem · Vendor Advisory
• http://securityfocus.com/bid/101647 · Note
• http://securitytracker.com/id/1039716 · Note