CVE-2017-12223

State: Published
Severity: Not scored
Published: Sep 7, 2017
Updated: Aug 5, 2024
Reserved: Aug 3, 2017

Description

A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an unsigned Hypervisor on an affected device and compromise the integrity of the system. The vulnerability is due to insufficient sanitization of user input. An attacker who can access an affected router via the console could exploit this vulnerability by entering ROMMON mode and modifying ROMMON variables. A successful exploit could allow the attacker to execute arbitrary code and install a malicious version of Hypervisor firmware on an affected device. Cisco Bug IDs: CSCvb44027.

Scores

The record has no CVSS score.

Weaknesses

CWE-20

Affected Products

Product	Versions
Cisco IR800 Integrated Services Routern/a	Cisco IR800 Integrated Services RouterAffected

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-isr
1039275vdb-entry
100689vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.