CVE-2017-12337

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration is performed on an affected device. When a refresh upgrade or PCD migration is completed successfully, an engineering flag remains enabled and could allow root access to the device with a known password. If the vulnerable device is subsequently upgraded using the standard upgrade method to an Engineering Special Release, service update, or a new major release of the affected product, this vulnerability is remediated by that action. Note: Engineering Special Releases that are installed as COP files, as opposed to the standard upgrade method, do not remediate this vulnerability. An attacker who can access an affected device over SFTP while it is in a vulnerable state could gain root access to the device. This access could allow the attacker to compromise the affected system completely. Cisco Bug IDs: CSCvg22923, CSCvg55112, CSCvg55128, CSCvg55145, CSCvg58619, CSCvg64453, CSCvg64456, CSCvg64464, CSCvg64475, CSCvg68797.

• CWE-287
• CWE-287

• http://www.securityfocus.com/bid/101865Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039813Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039814Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039815Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039816Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039817Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039818Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039819Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039820Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-vosVendor Advisory
• http://www.securityfocus.com/bid/101865Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039813Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039814Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039815Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039816Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039817Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039818Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039819Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039820Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-vosVendor Advisory

Published

Nov 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12331A vulnerability in Cisco NX-OS System Software could allow a…
• CVE-2017-12332A vulnerability in Cisco NX-OS System Software patch install…
• CVE-2017-12333A vulnerability in Cisco NX-OS System Software could allow a…
• CVE-2017-12334A vulnerability in the CLI of Cisco NX-OS System Software co…
• CVE-2017-12335A vulnerability in the CLI of Cisco NX-OS System Software co…
• CVE-2017-12336A vulnerability in the TCL scripting subsystem of Cisco NX-O…
• CVE-2017-12338A vulnerability in the CLI of Cisco NX-OS System Software co…
• CVE-2017-12339A vulnerability in the CLI of Cisco NX-OS System Software co…
• CVE-2017-1234IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting…
• CVE-2017-12340A vulnerability in Cisco NX-OS System Software running on Ci…
• CVE-2017-12341A vulnerability in the CLI of Cisco NX-OS System Software co…
• CVE-2017-12342A vulnerability in the Open Agent Container (OAC) feature of…