CVE-2017-12226 describes a privilege escalation vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software affecting Cisco 5760 Wireless LAN Controllers, Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, and NGWC 3850. This flaw, due to incomplete input validation, allows an authenticated remote attacker (Lobby Administrator) to elevate their privileges to administrator by manipulating HTTP requests during a connection state or protocol change. With a CVSS score of 8.8 (HIGH), a successful exploit grants full control over the affected device. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.7.0eCPE matchmatch criteria | cpe:2.3:o:cisco:ios_xe:3.7.0e:*:*:*:*:*:*:* | ||
3.7.1eCPE matchmatch criteria | cpe:2.3:o:cisco:ios_xe:3.7.1e:*:*:*:*:*:*:* | ||
3.7.2eCPE matchmatch criteria | cpe:2.3:o:cisco:ios_xe:3.7.2e:*:*:*:*:*:*:* | ||
3.7.3eCPE matchmatch criteria | cpe:2.3:o:cisco:ios_xe:3.7.3e:*:*:*:*:*:*:* | ||
3.7.4eCPE matchmatch criteria | cpe:2.3:o:cisco:ios_xe:3.7.4e:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.