CVE-2017-12306

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade package, aka Signature Verification Bypass. The vulnerability is due to insufficient upgrade package validation. An attacker could exploit this vulnerability by providing the upgrade process with an upgrade package that the attacker controls. An exploit could allow the attacker to install custom firmware to the Spark Board. Cisco Bug IDs: CSCvf84502.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-16CWE-494

Affected software

No affected versions have been published.

Timeline

Published
Nov 16, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-123076.1A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to coCVE-2017-123086.1A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to coCVE-2017-123095.3A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a HTTP response splitCVE-2017-12317.8IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910.CVE-2017-123107.5A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sCVE-2017-123115.8A vulnerability in the H.264 decoder function of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a Cisco MeetiCVE-2017-123126.7An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local aCVE-2017-123136.7An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow an authenticated, lCVE-2017-123147.8A vulnerability in the Cisco FindIT Network Discovery Utility could allow an authenticated, local attacker to perform a DLL preloading attacCVE-2017-123156.0A vulnerability in system logging when replication is being configured with the Cisco HyperFlex System could allow an authenticated, local aCVE-2017-123167.5A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to peCVE-2017-123176.7The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application
CVE-2017-12306: Medium severity, CVSS 4.4 | Vulnix