Login Request a demo
High severity · published Nov 16, 2017
CVE-2017-12350
A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an affected virtual appliance with root…
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an affected virtual appliance with root privileges. The vulnerability is due to the presence of default, static user credentials for an affected virtual appliance. An attacker could exploit this vulnerability by using the hypervisor console to connect locally to an affected system and then using the static credentials to log in to an affected virtual appliance. A successful exploit could allow the attacker to log in to the affected appliance with root privileges. Cisco Bug IDs: CSCvg31220.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UV
Umbrella Virtual Appliance · Cisco
through 2.1.0 · source: NVD
Affected product
UV
Umbrella Virtual Appliance
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12350
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12350
Third Party Advisory
http://www.securityfocus.com/bid/101879
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-uva
Third Party Advisory
https://www.info-sec.ca/advisories/Cisco-Umbrella-Hardcoded-Credentials.html
More from Umbrella Virtual Appliance
7.5
CVE-2022-20773
A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA
6.5
CVE-2022-20922
Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote…
6.4
CVE-2017-6679
The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto initiated from the customer's appliance to…
6.0
CVE-2026-20246
Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability