Lucene search

CiscoCVE-2017-6597

HistoryApr 07, 2017 - 5:59 p.m.

CVE-2017-6597

2017-04-0717:59:00

CWE-78

cisco

web.nvd.nist.gov

cve-2017-6597

cisco

ucs manager

firepower

ngfw

security appliance

vulnerability

command injection

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

A vulnerability in the local-mgmt CLI command of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. More Information: CSCvb61394 CSCvb86816. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1658) 2.0(1.115).

Affected configurations

Nvd

Node

ciscounified_computing_systemMatch3.1\(1k\)a

ciscofirepower_extensible_operating_systemMatch2.0\(1.68\)

VendorProductVersionCPE
ciscounified_computing_system3.1(1k)acpe:2.3:a:cisco:unified_computing_system:3.1\(1k\)a:*:*:*:*:*:*:*
ciscofirepower_extensible_operating_system2.0(1.68)cpe:2.3:o:cisco:firepower_extensible_operating_system:2.0\(1.68\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_computing_system	3.1(1k)a	cpe:2.3:a:cisco:unified_computing_system:3.1\(1k\)a:::::::*
cisco	firepower_extensible_operating_system	2.0(1.68)	cpe:2.3:o:cisco:firepower_extensible_operating_system:2.0\(1.68\):::::::*

CNA Affected

[
  {
    "product": "Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance"
      }
    ]
  }
]

References

www.securityfocus.com/bid/97476

www.securitytracker.com/id/1038195

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cli

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

Related for CVE-2017-6597