CVE-2017-12306

MEDIUM Year: 2017
CVSS v3 Score
4.4
Medium
CVSS v2 Score
2.1
Low
Weakness Type
CWE-16
View all →

Vulnerability Description

A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade package, aka Signature Verification Bypass. The vulnerability is due to insufficient upgrade package validation. An attacker could exploit this vulnerability by providing the upgrade process with an upgrade package that the attacker controls. An exploit could allow the attacker to install custom firmware to the Spark Board. Cisco Bug IDs: CSCvf84502.

Related Vulnerabilities

CVE-2019-19091

MEDIUM
CVSS:4.3(Medium)

For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to specifically craft the attack.

CWE-162019

CVE-2020-1769

MEDIUM
CVSS:4.3(Medium)

In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0....

CWE-162020

CVE-2025-20151

MEDIUM
CVSS:4.3(Medium)

A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker...

CWE-162025

CVE-2018-15448

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to discover sensitive user information. The attacker could use thi...

CWE-162018

CVE-2019-1868

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system information. The vulnerability is due to...

CWE-162019

CVE-2020-3484

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentially sensitive information on an affected ...

CWE-162020