CVE-2017-12786
CriticalSummary
Network interfaces of the cliengine and noviengine services in the NoviWare software may be inadvertently exposed during ACL modifications due to a bug in applying those modifications. This can lead to a stack-based buffer overflow, allowing remote, unauthenticated attackers to gain privileged (root) code execution on the switch.
Risk Assessment
The exposure of network interfaces poses a risk that unauthorized users may gain access to critical switch functions, potentially leading to serious security breaches within the organization's network.
Recommendation
It is recommended to update the NoviWare software to the latest version to mitigate this vulnerability and to monitor and restrict access to the network interfaces of the switches.
Original NVD description (English source)
Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be leveraged by remote, unauthenticated attackers to gain resultant privileged (root) code execution on the switch, because there is a stack-based buffer overflow during unserialization of packet data.