CVE-2017-12332

A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vulnerability is due to insufficient restrictions in the patch installation process. An attacker could exploit this vulnerability by installing a crafted patch image on an affected device. The vulnerable operation occurs prior to patch activation. An exploit could allow the attacker to write arbitrary files on an affected system as root. The attacker would need valid administrator credentials to perform this exploit. This vulnerability affects the following products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Fabric Extenders, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Unified Computing System Manager. Cisco Bug IDs: CSCvf16513, CSCvf23794, CSCvf23832.

• CWE-434
• CWE-434

• http://www.securityfocus.com/bid/102160
• http://www.securitytracker.com/id/1039931Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos1Vendor Advisory
• http://www.securityfocus.com/bid/102160
• http://www.securitytracker.com/id/1039931Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos1Vendor Advisory

Published

Nov 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12323Multiple vulnerabilities in the web interface of the Cisco R…
• CVE-2017-12328A vulnerability in Session Initiation Protocol (SIP) call ha…
• CVE-2017-12329A vulnerability in the CLI of Cisco Firepower Extensible Ope…
• CVE-2017-1233IBM Remote Control v9 could allow a local user to use the co…
• CVE-2017-12330A vulnerability in the CLI of Cisco NX-OS System Software co…
• CVE-2017-12331A vulnerability in Cisco NX-OS System Software could allow a…
• CVE-2017-12333A vulnerability in Cisco NX-OS System Software could allow a…
• CVE-2017-12334A vulnerability in the CLI of Cisco NX-OS System Software co…
• CVE-2017-12335A vulnerability in the CLI of Cisco NX-OS System Software co…
• CVE-2017-12336A vulnerability in the TCL scripting subsystem of Cisco NX-O…
• CVE-2017-12337A vulnerability in the upgrade mechanism of Cisco collaborat…
• CVE-2017-12338A vulnerability in the CLI of Cisco NX-OS System Software co…