CVE-2017-12306

A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade package, aka Signature Verification Bypass. The vulnerability is due to insufficient upgrade package validation. An attacker could exploit this vulnerability by providing the upgrade process with an upgrade package that the attacker controls. An exploit could allow the attacker to install custom firmware to the Spark Board. Cisco Bug IDs: CSCvf84502.

• CWE-16
• CWE-494

• http://www.securityfocus.com/bid/101914Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-sparkVendor Advisory
• http://www.securityfocus.com/bid/101914Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-sparkVendor Advisory

Published

Nov 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12300A vulnerability in the SNORT detection engine of Cisco Firep…
• CVE-2017-12301A vulnerability in the Python scripting subsystem of Cisco N…
• CVE-2017-12302A vulnerability in the Cisco Unified Communications Manager …
• CVE-2017-12303A vulnerability in the Advanced Malware Protection (AMP) fil…
• CVE-2017-12304A vulnerability in the IOS daemon (IOSd) web-based managemen…
• CVE-2017-12305A vulnerability in the debug interface of Cisco IP Phone 880…
• CVE-2017-12307A vulnerability in the web framework of Cisco Small Business…6.1
• CVE-2017-12308A vulnerability in the web framework of Cisco Small Business…6.1
• CVE-2017-12309A vulnerability in the Cisco Email Security Appliance (ESA) …
• CVE-2017-1231IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in p…4.4
• CVE-2017-12310A vulnerability in the auto discovery phase of Cisco Spark H…
• CVE-2017-12311A vulnerability in the H.264 decoder function of Cisco Meeti…