CVE-2017-12787
CriticalSummary
The novi_process_manager_daemon service in the NoviWare software may be inadvertently exposed when an operator attempts to modify access control lists (ACLs). A bug in applying these modifications could allow remote, unauthenticated attackers to gain privileged (root) code execution on the switch.
Risk Assessment
The organization may face a serious threat as attackers could gain full access to network devices, potentially leading to data loss or control over the infrastructure.
Recommendation
It is recommended to immediately update the NoviWare software to the latest version to mitigate this vulnerability and to review and verify ACL configurations to ensure security.
Original NVD description (English source)
A network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be leveraged by remote, unauthenticated attackers to gain resultant privileged (root) code execution on the switch, because incoming packet data can contain embedded OS commands, and can also trigger a stack-based buffer overflow.