CVE-2017-12337 (CNNVD-201711-660)
中文标题:
多款Cisco产品授权问题漏洞
英文标题:
A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Op...
漏洞描述
中文描述:
Cisco Voice Operating System是美国思科（Cisco）公司的一套语音操作系统。Cisco Unified Communications Manager（UCM）等都是基于Cisco Voice Operating System平台的产品。Cisco Unified Communications Manager（UCM）是一款统一通信系统中的呼叫处理组件。Unified Communication Manager Session Management Edition（SME）是它的会话管理版。 基于Cisco Voice Operating System的多款Cisco产品中的更新机制存在安全漏洞。远程攻击者可利用该漏洞获取提升的访问权限。以下产品受到影响：Cisco Unified Communications Manager (UCM)；Unified Communication Manager Session Management Edition (SME)；Emergency Responder；Unity ConnectionCisco Unified Communications Manager IM and Presence Service (IMP，前称：Cisco Unified Presence)；Prime License Manager；Hosted Collaboration Mediation Fulfillment；Unified Contact Center Express (UCCx)；SocialMiner；Unified Intelligence Center (UIC)；Finesse；MediaSense。
英文描述:
A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration is performed on an affected device. When a refresh upgrade or PCD migration is completed successfully, an engineering flag remains enabled and could allow root access to the device with a known password. If the vulnerable device is subsequently upgraded using the standard upgrade method to an Engineering Special Release, service update, or a new major release of the affected product, this vulnerability is remediated by that action. Note: Engineering Special Releases that are installed as COP files, as opposed to the standard upgrade method, do not remediate this vulnerability. An attacker who can access an affected device over SFTP while it is in a vulnerable state could gain root access to the device. This access could allow the attacker to compromise the affected system completely. Cisco Bug IDs: CSCvg22923, CSCvg55112, CSCvg55128, CSCvg55145, CSCvg58619, CSCvg64453, CSCvg64456, CSCvg64464, CSCvg64475, CSCvg68797.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| cisco | emergency_responder | - | - | - |
cpe:2.3:a:cisco:emergency_responder:-:*:*:*:*:*:*:*
|
| cisco | finesse | - | - | - |
cpe:2.3:a:cisco:finesse:-:*:*:*:*:*:*:*
|
| cisco | hosted_collaboration_solution | - | - | - |
cpe:2.3:a:cisco:hosted_collaboration_solution:-:*:*:*:*:*:*:*
|
| cisco | mediasense | - | - | - |
cpe:2.3:a:cisco:mediasense:-:*:*:*:*:*:*:*
|
| cisco | prime_license_manager | - | - | - |
cpe:2.3:a:cisco:prime_license_manager:-:*:*:*:*:*:*:*
|
| cisco | socialminer | - | - | - |
cpe:2.3:a:cisco:socialminer:-:*:*:*:*:*:*:*
|
| cisco | unified_communications_manager | - | - | - |
cpe:2.3:a:cisco:unified_communications_manager:-:*:*:*:*:*:*:*
|
| cisco | unified_communications_manager_im_and_presence_service | - | - | - |
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:-:*:*:*:*:*:*:*
|
| cisco | unified_contact_center_express | - | - | - |
cpe:2.3:a:cisco:unified_contact_center_express:-:*:*:*:*:*:*:*
|
| cisco | unified_intelligence_center | - | - | - |
cpe:2.3:a:cisco:unified_intelligence_center:-:*:*:*:*:*:*:*
|
| cisco | unity_connection | - | - | - |
cpe:2.3:a:cisco:unity_connection:-:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2017-12337 |
2025-11-11 15:19:17 | 2025-11-11 07:34:33 |
| NVD | nvd_CVE-2017-12337 |
2025-11-11 14:55:33 | 2025-11-11 07:43:12 |
| CNNVD | cnnvd_CNNVD-201711-660 |
2025-11-11 15:09:56 | 2025-11-11 07:53:25 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201711-660
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.CRITICAL
- cvss_score: 未提取 -> 9.8
- cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss_version: NOT_EXTRACTED -> 3.0
- affected_products_count: 0 -> 11
- data_sources: ['cve'] -> ['cve', 'nvd']