CVE-2017-12278

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Wireless LAN Controllers could allow an authenticated, remote attacker to cause an affected device to restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a memory leak that occurs on an affected device after the device fails to deallocate a buffer that is used when certain MIBs are polled. An attacker who knows the SNMP Version 2 SNMP Read string or has valid SNMP Version 3 credentials for an affected device could repeatedly poll the affected MIB object IDs (OIDs) and consume available memory on the device. When memory is sufficiently depleted on the device, the device will restart, resulting in a DoS condition. Cisco Bug IDs: CSCvc71674.

Metrics

CVSS 3.0 6.3/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-119CWE-772

Affected software

No affected versions have been published.

Timeline

Published
Nov 2, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-122794.3A vulnerability in the packet processing code of Cisco IOS Software for Cisco Aironet Access Points could allow an unauthenticated, adjacentCVE-2017-12283.7IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the fCVE-2017-122807.5A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) Discovery Request parsing functionality of Cisco WirelessCVE-2017-122817.5A vulnerability in the implementation of Protected Extensible Authentication Protocol (PEAP) functionality for standalone configurations of CVE-2017-122826.1A vulnerability in the Access Network Query Protocol (ANQP) ingress frame processing functionality of Cisco Wireless LAN Controllers could aCVE-2017-122836.1A vulnerability in the handling of 802.11w Protected Management Frames (PAF) by Cisco Aironet 3800 Series Access Points could allow an unautCVE-2017-122845.5A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profilCVE-2017-122855.3A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbCVE-2017-122865.5A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from CVE-2017-122874.3A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video CommunicCVE-2017-122886.1A vulnerability in the web-based management interface of Cisco Unified Contact Center Express could allow an unauthenticated, remote attackeCVE-2017-122894.4A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local att