THREATPORT/VULNERABILITY/CVE-2017-12337
CRITICAL SEVERITY

CVE-2017-12337

Emergency Responder vulnerability

CVSS
9.8
EPSS
6.4%
EPSS pct
93th
Exploited
No known
A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration is performed on an affected device. When a refresh upgrade or PCD migration is completed successfully, an engineering flag remains enabled and could allow root access to the device with a known password. If the vulnerable device is subsequently upgraded using the standard upgrade method to an Engineering Special Release, service update, or a new major release of the affected product, this vulnerability is remediated by that action. Note: Engineering Special Releases that are installed as COP files, as opposed to the standard upgrade method, do not remediate this vulnerability. An attacker who can access an affected device over SFTP while it is in a vulnerable state could gain root access to the device. This access could allow the attacker to compromise the affected system completely. Cisco Bug IDs: CSCvg22923, CSCvg55112, CSCvg55128, CSCvg55145, CSCvg58619, CSCvg64453, CSCvg64456, CSCvg64464, CSCvg64475, CSCvg68797.
Affected vendor
Cisco
Affected product
Emergency Responder
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness type (CWE)
  • CWE-287 — Improper Authentication
Published
2017-11-16

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable over the network, low attack complexity, requiring no privileges, no user interaction. Successful exploitation leads to high impact to confidentiality, high impact to integrity, high impact to availability.

Its EPSS score of 6.4% reflects a lower probability of exploitation activity in the wild over the next 30 days, placing it above 93% of all scored CVEs.

Check your external exposure to CVE-2017-12337

  • Confirm whether Cisco Emergency Responder is running on any internet-facing host or subdomain.
  • Match discovered service fingerprints against the version affected by CVE-2017-12337.
  • Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2017-12337

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2017-12337 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2017-12337?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2017-12337.

Start free scan

No credit card. Agentless.

Related vulnerabilities

CRITICAL
CVE-2025-23061
Mongoose vulnerability
CRITICAL
CVE-2025-22905
Re11s Firmware vulnerability
CRITICAL
CVE-2024-57684
Dir 816 Firmware vulnerability