Skip to content
Fencer Intel
medium 5.3

CVE-2017-12285 json

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete ar…

published 9y ago modified 4mo ago also EUVD-2017-3858

cvss
5.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
37.2%
EPSS 37.2% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system, aka Directory Traversal. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests that it receives and the software does not apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to delete arbitrary files from the affected system. Cisco Bug IDs: CSCvf41365.

Is CVE-2017-12285 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

37.19% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P

Affected products

  • n/a Cisco Network Analysis Module

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.