CVE-2017-12243: Cisco UCS Manager and Firepower command injection grants root shell

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRoot-level command injection on security and management appliances with a high CVSS score and very high EPSS, though it requires authenticated local access and is not in KEV.

What it is

Cisco UCS Manager, Firepower 4100 Series NGFW and Firepower 9300 Security Appliance fail to properly validate string input in a shell application, allowing OS command injection (CWE-78). An attacker with local access and valid credentials can inject malicious commands to escalate to root shell privileges on the device. Because the affected platforms are security and infrastructure management appliances, root compromise undermines the trust boundary they enforce.

Impact

An attacker gains root shell privileges on the appliance, giving full control of the device and any data or configuration it manages. This can enable persistent access, tampering with firewall or UCS management functions, and lateral movement into managed infrastructure.

Attack surface

Reached locally on the device via the shell application, per the CVSS vector AV:L. Exploitation requires authenticated local access (PR:L) and no user interaction (UI:N).

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high at 0.77071 (99.5th percentile), indicating elevated predicted exploitation activity. No ransomware group usage is documented.

What to do

• Apply the Cisco vendor advisory cisco-sa-20171101-arce fixes for UCS Manager, Firepower 4100 and Firepower 9300.
• Restrict and audit local shell and CLI accounts on affected appliances; remove unnecessary local users.
• Enforce least privilege so operators do not hold accounts capable of reaching the vulnerable shell application.
• Monitor Cisco advisories for updated fixed releases and verify installed versions against them.

Detection

• Audit appliance logs for unexpected shell command execution or privilege escalation to root by non-admin accounts.
• Alert on new or modified local accounts and on interactive shell sessions on UCS Manager and Firepower appliances.
• Baseline normal CLI/shell usage per administrator and flag deviations, especially command chaining or shell metacharacters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.