CVE-2017-3873

CVE-2017-3873 describes a critical vulnerability in the Plug-and-Play (PnP) subsystem of specific Cisco Aironet 1800, 2800, and 3800 Series Access Points running Lightweight AP or Mobility Express images, specifically software version 8.3.102.0. This flaw, stemming from insufficient validation of PnP server responses, allows an unauthenticated, adjacent attacker to execute arbitrary code with root privileges. The vulnerability is exploitable only during the initial boot or after a factory reset, when the device lacks a configuration. Rated 7.5 HIGH on the CVSS scale (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack requires adjacency and high attack complexity, as the attacker must respond to PnP requests within a narrow window, potentially before a legitimate APIC-EM response. Successful exploitation grants full control over the device. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, indicating low public attention.