Skip to content
Fencer Vulns
medium 5.3

CVE-2017-12285 json

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete ar…

published 2017-10-19 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-3858

cvss
5.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
37.2%
EPSS 37.2% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system, aka Directory Traversal. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests that it receives and the software does not apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to delete arbitrary files from the affected system. Cisco Bug IDs: CSCvf41365.

Exploit prediction

37.19% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P

Affected products

  • n/a Cisco Network Analysis Module

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.