Read the docs
TI-2017-09088 Aliases CVE-2017-12312GHSA-rpc8-p8rc-75gr

Improper input validation in Cisco Immunet Antimalware Installer

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local attacker to execute arbitrary code via DLL hijacking if a local user with administrative privileges executes the installer in the current working directory where a crafted DLL has been placed by an attacker. The vulnerability is due to incomplete input validation of path and file names of a DLL file before it is loaded. An attacker could exploit this vulnerability by creating a malicious DLL file and installing it in a specific system directory. A successful exploit could allow the attacker to execute commands on the underlying Microsoft Windows host with privileges equivalent to the SYSTEM account. An attacker would need valid user credentials to exploit this vulnerability. Cisco Bug IDs: CSCvf23928.

Why it matters now

EPSS 0.00536 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Immunet Antimalware InstallerCisco Immunet Antimalware Installer—No fix listedCNA
  • Cisco Immunet Antimalware Installer Vendor— Affected Cisco Immunet Antimalware Installer Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:advanced_malware_protection_for_endpoints:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableCisco
  • cpe:2.3:a:cisco:advanced_malware_protection_for_endpoints:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12312
  2. 2026-10-03 Alias added: GHSA-rpc8-p8rc-75gr

References

Advisory 1

  • TI-2021-01113 Uncontrolled search path in Cisco AMP for Endpoints CVSS 3.1HIGH 7.8
  • TI-2021-01007 Cisco Advanced Malware Protection for Endpoints and Immunet for Windows DLL Hijacking Vulnerability CVSS 3.1HIGH 7.8
  • TI-2018-00199 Improper input validation in Cisco AMP for Endpoints CVSS 3.1MEDIUM 5.8
  • TI-2019-01552 Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability CVSS 3.0MEDIUM 6.7
  • TI-2018-11012 Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability CVSS 3.0MEDIUM 6.7
  • TI-2018-00356 Resource management flaw in Cisco AMP for Endpoints Mac Connector unknown CVSS 3.0MEDIUM 5.9
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences