CVE-2017-12285

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system, aka Directory Traversal. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests that it receives and the software does not apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to delete arbitrary files from the affected system. Cisco Bug IDs: CSCvf41365.

• CWE-20
• CWE-20
• CWE-22

• http://www.securityfocus.com/bid/101527Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039623Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-namVendor Advisory
• http://www.securityfocus.com/bid/101527Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039623Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-namVendor Advisory

Published

Oct 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1228IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5…
• CVE-2017-12280A vulnerability in the Control and Provisioning of Wireless …
• CVE-2017-12281A vulnerability in the implementation of Protected Extensibl…
• CVE-2017-12282A vulnerability in the Access Network Query Protocol (ANQP) …
• CVE-2017-12283A vulnerability in the handling of 802.11w Protected Managem…
• CVE-2017-12284A vulnerability in the web interface of Cisco Jabber for Win…
• CVE-2017-12286A vulnerability in the web interface of Cisco Jabber could a…
• CVE-2017-12287A vulnerability in the cluster database (CDB) management com…
• CVE-2017-12288A vulnerability in the web-based management interface of Cis…
• CVE-2017-12289A vulnerability in conditional, verbose debug logging for th…
• CVE-2017-1229IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) could a…
• CVE-2017-12290Multiple vulnerabilities in the web interface of the Cisco R…