CVE-2017-12223CWE-20

A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an…

published September 7, 2017

CVSS
—
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an unsigned Hypervisor on an affected device and compromise the integrity of the system. The vulnerability is due to insufficient sanitization of user input. An attacker who can access an affected router via the console could exploit this vulnerability by entering ROMMON mode and modifying ROMMON variables. A successful exploit could allow the attacker to execute arbitrary code and install a malicious version of Hypervisor firmware on an affected device. Cisco Bug IDs: CSCvb44027.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00416 · 34.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2017-09-07T21:00Z
EPSS history
Timeline
  • 07 SEP 21:00Z
    A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an…
    cvelistv5