CVE-2017-3806CWE-78command-injection

CVE-2017-3806

Medium · published February 3, 2017

CVSS v3.0
5.3
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

A vulnerability in CLI command processing in the Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to inject arbitrary shell commands that are executed by the device. More Information: CSCvb61343. Known Affected Releases: 2.0(1.68). Known Fixed Releases: 2.0(1.118) 2.1(1.47) 92.1(1.1646) 92.1(1.1763) 92.2(1.101).

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2017-02-03T12:59Z
Affected products (5)
ProductVersionsFixed in
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
References (4)
http://www.securityfocus.com/bid/95943 · [email protected]https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fpw · [email protected]http://www.securityfocus.com/bid/95943 · af854a3a-2127-422b-91ae-364da2661108https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fpw · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 FEB 07:24Z
    A vulnerability in CLI command processing in the Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance could allow…
    cvelistv5