Read the docs
TI-2017-09124 Aliases CVE-2017-12352GHSA-vjpq-xwhg-4jr4

Command injection in Cisco Application Policy Infrastructure Controller

Priority LOW 30CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could allow an authenticated, local attacker to gain elevated privileges and execute arbitrary commands with root privileges on an affected host operating system. The vulnerability is due to insufficient validation of user-controlled input that is supplied to certain script files of an affected system. An attacker could exploit this vulnerability by submitting crafted input to a script file on an affected system. A successful exploit could allow the attacker to gain elevated privileges and execute arbitrary commands with root privileges on the affected system. To exploit this vulnerability, the attacker would need to authenticate to the affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf57274.

Why it matters now

EPSS 0.00445 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Application Policy Infrastructure ControllerCisco Application Policy Infrastructure Controller—No fix listedCNA
  • Cisco Application Policy Infrastructure Controller Vendor— Affected Cisco Application Policy Infrastructure Controller Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:application_policy_infrastructure_controller:2.3\(1f\):*:*:*:*:*:*:*2.3(1f)VulnerableCisco
  • cpe:2.3:a:cisco:application_policy_infrastructure_controller:2.3\(1f\):*:*:*:*:*:*:* Versions 2.3(1f) Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12352
  2. 2026-10-03 Alias added: GHSA-vjpq-xwhg-4jr4

References

Advisory 1

  • TI-2021-01115 Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2021-01120 Cisco Application Services Engine Unauthorized Access Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2021-01123 Cisco Application Services Engine Unauthorized Access Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2021-01301 Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2021-01305 Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities CVSS 3.1CRITICAL 9.1
  • TI-2021-01302 Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability CVSS 3.1HIGH 8.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences