CASCACascade Atlas

Evidence dossier

CVE-2017-12240

The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute…

Exploited in the wild (CISA KEV since Mar 3, 2022). NVD reports CVSS 3.1 9.8. EPSS estimates 13.9% exploit likelihood as of Aug 27, 2026.

74.6–76.1Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.

State
PUBLISHED
Published
Sep 28, 2017
Updated
Jan 12, 2026
Evidence coverage
92%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    cisco

    Record text: The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.

    Inspect raw assertion
    Field
    container
    Value
    The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 13.88% probability · 96.25th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.138830000000; percentile 0.962490000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Mar 3, 2022 · first observed Jul 19, 2026

Exploit likelihood13.88%

FIRST EPSS · score date Aug 27, 2026 · 96.2th percentile · first observed Aug 27, 2026

SeverityCVSS 9.8

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Aug 27, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Aug 27, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
ciscoOriginal assertion
Record text

The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.

Inspect raw assertion
Field
container
Value
The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

13.88% probability · 96.25th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.138830000000; percentile 0.962490000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
265Underlying assertions
265Canonical products
1Target assertions
264Constraint assertions

Grouped from 2 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

266 scope groups

cisco · source assertedn/aCisco IOS and IOS XEDirect source scope
Affected: Cisco IOS and IOS XE
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "Cisco IOS and IOS XE"}]
NVD CPE · HARDWAREcisco1000_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-9bf024cf178e916b346a687100957e1486ab0e38c6fa80bc2142b827451f1ccdLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f4856e07-b3c2-4674-9584-866f6af643b2
NVD CPE · HARDWAREcisco1100-4g_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-0885dd02cc9452d4f4041009f4e89e39aa9cb7b3a2241eb0568d5272a45ba686Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0f77cd6a-83da-4f31-a128-ad6daecd623b
NVD CPE · HARDWAREcisco1100-4gltegb_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-b9efc8776dfa030fc1668cb394abb81fc795e977fed11311afb0182182422ccbLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    62564bb8-1282-4597-a645-056298be7ccb
NVD CPE · HARDWAREcisco1100-4gltena_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-7b470689aeb6ceafca57d7e299857f428598c78d5b6b9cf3a7ac1b46fa6cd4e3Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    80e9cc47-3d7c-437a-85be-4bb94c8af1b8
NVD CPE · HARDWAREcisco1100-4p_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-61bd7c4a997f0057522432fc32977f3bee0e3ca7f1e9b52a1c315fc5b0c94b82Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a2d2305b-b69e-4f74-a44e-07b3205ce9f7
NVD CPE · HARDWAREcisco1100-6g_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-48496322b8049136b306dd98a470fd79e435e1ed18fde6815354449b60512192Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2b68b363-3c57-4e95-8b13-0f9b59d551f7
NVD CPE · HARDWAREcisco1100-8p_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-397442e23e2a34298ff5a325e65f923a74b06f578053f14f452c10a8f3897e60Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    26dd41b3-1d1d-44d3-ba8e-5a66afee77e6
NVD CPE · HARDWAREcisco1100_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-e5fb7db7e3021671cae1c5fbc328d90008a6d7f3443554172e2f56006322542aLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1100_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1952b64c-4ae0-4ccb-86c5-8d1ff6a12822
NVD CPE · HARDWAREcisco1100-lte_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-a7b821aaea42226be44a09c95bedd3a1b6cd867ba27bb56597900ea8599547ebLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1100-lte_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ebe4e146-1d77-4f15-ae58-3c1ce5db62c5
NVD CPE · HARDWAREcisco1101-4p_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-9fda7bc5de4a65dc7bb0a3527f9fe8dac39b87fcc5d0d9c845d90d07d056b28cLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5aad4397-6dcf-493a-bd61-3a890f6f3ab2
NVD CPE · HARDWAREcisco1101_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-6d06967d013c5208818969e6a3f9fd97997fde602c3de99ee5dc56b6b58da475Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1101_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5eb8a757-7888-4ac2-be44-b89db83c6c77
NVD CPE · HARDWAREcisco1109-2p_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-a320671625d66c0f5e525c6800954b21a7539790b5f2cdeaeeac5a18b6e41881Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3f2f0a8e-97f6-41ac-be67-4b2d60f9d36b
NVD CPE · HARDWAREcisco1109-4p_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-ba8c68f373165e04bc790264843055a058f32acb0a6b010ab8d817e41f45eb16Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bb9229f3-7bce-46c4-9879-d57b5baae44e
NVD CPE · HARDWAREcisco1109_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-5acf21099ac27170d3dbdecffd55c65a94fea428b95bebfe590ab4648c76a62bLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1109_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b80890a8-e3d3-462c-b125-9e9bc6525b02
NVD CPE · HARDWAREcisco1111x-8p_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-796a0d294e7bc7b82cb47666d5ac1c3619298798ea161b8312b14c57aa25d183Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 14
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a5a606fe-e6f1-43f9-b1cd-d9df35fc3573
NVD CPE · HARDWAREcisco1111x_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-d92e68f54c6af83a9a713f685ae040d64338dfd1854b167b47da281717d69c4fLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1111x_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 15
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0547e196-5991-4c33-823a-342542e9dfd3
NVD CPE · HARDWAREcisco111x_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-2eb85d470eea33297206ee077ee1a7ebe94b8bbfb1e21f3a9be41146e5df9c02Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:111x_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 16
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    802cbfc1-8a2f-4bf7-a1d3-00622c33be16
NVD CPE · HARDWAREcisco1120_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-eff07dedb7ca14479c13542287b11082c9f6a3c96014bae8d278ab140d05e778Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1120_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 17
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7afe0fc1-eebc-42f0-88b0-4af5b76ddd97
NVD CPE · HARDWAREcisco1131_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-e3a1fbf4a9275ee1dfcf01b86353961bb6466ca0c2890cd84432fe24ed94f8e2Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1131_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 18
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f3f374dc-b9f7-4515-a064-01bb436ca984
NVD CPE · HARDWAREcisco1160_integrated_services_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-86e902040c8bc39f6147c90be698b668a9c258a6ef01c1b325aab7cf716bb8d0Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1160_integrated_services_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 19
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d916389f-54db-44cb-91dd-7ce3c7059350
NVD CPE · HARDWAREcisco1801_integrated_service_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-841b927ded4b0cbd0b31e62a35603de6ccc657baf010b847d78ae26406b2ee8aLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1801_integrated_service_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 20
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6d5e48d7-2266-4649-90a9-62c476afe6de
NVD CPE · HARDWAREcisco1802_integrated_service_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-8caea46771ac3cd77007991815b2cb70dfd97e8e10c1f631e2c1cd649b08ac47Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1802_integrated_service_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 21
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    99581637-e184-4a02-8313-57c7c31e5479
NVD CPE · HARDWAREcisco1803_integrated_service_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-c87049704a6cd6a16db82b76d1d8fda85452b9c5733b6927c0207e248f31eae0Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1803_integrated_service_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 22
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9c6d4a90-31b9-4b6c-adac-44c49db44115
NVD CPE · HARDWAREcisco1811_integrated_service_routerEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-50764973fc4b6427f1138b3203c4fe8e45612ab6f6b4ee1b9590a763d050d715Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:cisco:1811_integrated_service_router:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 23
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b3af3f75-0bd8-4aa6-b696-3624bee86681

Affected-product evidence

Accepted scope and product mapping

1 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-0774b265c0e837e737aaf99ed0f2450c048e61f34267ca59d8623878b839334e · product-5972f4392170d0d1b4e75a10eb3b383835ead601c8d9b09329525407a4e1471a

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
2ed87ab8-0dec-4780-85ae-46c6e83e3b37
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
42fdf6bc-59c1-4434-8a17-b436e0a74d1f

Assessments

CVSS by origin

9.8
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10.0
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:L/Au:N/C:C/I:C/A:C
9.8
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Direct CVE/CNA normalized decisions

9.8Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Validation
Valid match
Recomputed
9.8
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.