CVE-2017-6714 | BDVDB-2026-87346 Detail

Cisco Ultra Services Framework

Description#

A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The vulnerability is due to improper shell invocations. An attacker could exploit this vulnerability by crafting CLI command inputs to execute Linux shell commands as the root user. This vulnerability affects all releases of Cisco Ultra Services Framework Staging Server prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76673.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References#

http://www.securityfocus.com/bid/99436
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf3

Exploit#

No public exploit known

History#

Version 12017-07-06Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.