Read the docs
TI-2017-09109 Aliases CVE-2017-12337GHSA-rg7v-73fx-2hfh

Improper authentication in Cisco Voice Operating System

Priority MEDIUM 51CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration is performed on an affected device. When a refresh upgrade or PCD migration is completed successfully, an engineering flag remains enabled and could allow root access to the device with a known password. If the vulnerable device is subsequently upgraded using the standard upgrade method to an Engineering Special Release, service update, or a new major release of the affected product, this vulnerability is remediated by that action. Note: Engineering Special Releases that are installed as COP files, as opposed to the standard upgrade method, do not remediate this vulnerability. An attacker who can access an affected device over SFTP while it is in a vulnerable state could gain root access to the device. This access could allow the attacker to compromise the affected system completely. Cisco Bug IDs: CSCvg22923, CSCvg55112, CSCvg55128, CSCvg55145, CSCvg58619, CSCvg64453, CSCvg64456, CSCvg64464, CSCvg64475, CSCvg68797.

Why it matters now

EPSS 0.06435 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Voice Operating SystemCisco Voice Operating System—No fix listedCNA
  • Cisco Voice Operating System Vendor— Affected Cisco Voice Operating System Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:cisco:emergency_responder:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:finesse:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:hosted_collaboration_solution:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:mediasense:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:prime_license_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:socialminer:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:-:*:*:*:session_management:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
  • cpe:2.3:a:cisco:emergency_responder:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:finesse:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:hosted_collaboration_solution:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:mediasense:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_license_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:socialminer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:-:*:*:*:session_management:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:unified_intelligence_center:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:unity_connection:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
  • cpe:2.3:a:cisco:unified_intelligence_center:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unity_connection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12337
  2. 2026-10-03 Alias added: GHSA-rg7v-73fx-2hfh

References

Advisory 1

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2005-00319 Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with… CVSS 2.0MEDIUM 5.0
  • TI-2023-06808 Hard-coded credentials in Cisco Emergency Responder CVSS 3.1CRITICAL 9.8
  • TI-2008-01106 The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications… CVSS 2.0HIGH 10.0
  • TI-2004-01636 The default installation of Cisco voice products, when running the IBM Director Agent on… CVSS 2.0HIGH 10.0
  • TI-2017-04533 Resource management flaw in Multiple Cisco Products unknown CVSS 3.0HIGH 7.5
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences