CVE-2017-12785: Noviflow Noviware

Critical severity, CVSS 9.8. EPSS: 16% chance of exploitation in the next 30 days.

The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is prone to a buffer overflow in the "show log cli" command. This could be used by a read-only user (monitor role) to gain privileged (root) code execution on the switch via command injection.

Affected products

• Noviflow Noviware: up to and including 400.2.6

Published 2017-08-22. Last modified 2026-06-17.