CVE-2017-3873

{"id": "CVE-2017-3873", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.9, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2017-05-16T17:29:00.213", "references": [{"url": "http://www.securityfocus.com/bid/98296", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1038394", "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cme", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Plug-and-Play (PnP) subsystem of the Cisco Aironet 1800, 2800, and 3800 Series Access Points running a Lightweight Access Point (AP) or Mobility Express image could allow an unauthenticated, adjacent attacker to execute arbitrary code with root privileges. The vulnerability is due to insufficient validation of PnP server responses. The PnP feature is only active while the device does not contain a configuration, such as a first time boot or after a factory reset has been issued. An attacker with the ability to respond to PnP configuration requests from the affected device can exploit the vulnerability by returning malicious PnP responses. If a Cisco Application Policy Infrastructure Controller - Enterprise Module (APIC-EM) is available on the network, the attacker would need to exploit the issue in the short window before a valid PnP response was received. If successful, the attacker could gain the ability to execute arbitrary code with root privileges on the underlying operating system of the device. Cisco has confirmed that the only vulnerable software version is 8.3.102.0. Cisco Bug IDs: CSCvb42386."}, {"lang": "es", "value": "Una vulnerabilidad en el subsistema Plug-and-Play (PnP) de los Puntos de Acceso Aironet 1800, 2800, y 3800 Series de Cisco que ejecutan una imagen de Lightweight Access Point (AP) o Mobility Express, podr\u00eda permitir que un atacante adyacente no autenticado ejecute c\u00f3digo arbitrario con privilegios root. La vulnerabilidad es debido a la comprobaci\u00f3n insuficiente de las respuestas del servidor PnP. La funcionalidad PnP solo est\u00e1 activa mientras que el dispositivo no contenga una configuraci\u00f3n, como un arranque por primera vez o despu\u00e9s de que se haya emitido un restablecimiento de f\u00e1brica. Un atacante con la capacidad de responder a las peticiones de configuraci\u00f3n PnP desde el dispositivo afectado puede explotar la vulnerabilidad mediante la devoluci\u00f3n de respuestas PnP maliciosas. Si un Application Policy Infrastructure Controller - Enterprise Module (APIC-EM) de Cisco est\u00e1 disponible en la red, el atacante necesitar\u00eda explotar el problema en la ventana corta antes de que se recibiera una respuesta v\u00e1lida PnP. Si tiene \u00e9xito, el atacante podr\u00eda conseguir la capacidad de ejecutar c\u00f3digo arbitrario con privilegios root en el sistema operativo subyacente del dispositivo. Cisco ha confirmado que la \u00fanica versi\u00f3n de software vulnerable es 8.3.102.0. ID de bug de Cisco: CSCvb42386."}], "lastModified": "2017-07-11T01:33:44.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:aironet_access_point_firmware:8.3_102.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "314B7D2D-41BB-4041-8131-4F931FD9C8D2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:aironet_1830e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4590D445-B4B6-48E6-BF55-BEA6BA763410"}, {"criteria": "cpe:2.3:h:cisco:aironet_1830i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "848CC5CD-1982-4F31-A626-BD567E1C19F0"}, {"criteria": "cpe:2.3:h:cisco:aironet_1850e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "24E47788-9B54-42C5-AD83-428B22674575"}, {"criteria": "cpe:2.3:h:cisco:aironet_1850i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A333CD0B-4729-4E64-8B52-A3F5138F5B70"}, {"criteria": "cpe:2.3:h:cisco:aironet_2800e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "098A82FF-95F7-416A-BADD-C57CE81ACD32"}, {"criteria": "cpe:2.3:h:cisco:aironet_2800i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DD1D5813-9223-4B3F-9DE2-F3EF854FC927"}, {"criteria": "cpe:2.3:h:cisco:aironet_3800e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "10D7583E-2B61-40F1-B9A6-701DA08F8CDF"}, {"criteria": "cpe:2.3:h:cisco:aironet_3800i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "945DDBE7-6233-416B-9BEE-7029F047E298"}, {"criteria": "cpe:2.3:h:cisco:aironet_3800p:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0ED89428-750C-4C26-B2A1-E3D63F8B3F44"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}