Vulnslist

find the latest Cisco vulnerabilities

Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance CLI Command Injection Vulnerability

cisco-sa-20170405-ucs1 · Medium · Published · Updated

A vulnerability in the CLI of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation for the affected command. An authenticated local attacker could exploit this vulnerability by injecting crafted command arguments into a redirect of a vulnerable CLI command. An exploit could allow the attacker to execute arbitrary system commands with the privileges of the authenticated user. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucs1

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

CVEsCVE-2017-6600
Cisco Bug IDsCSCvb61351, CSCvb61637
CVSS ScoreBase 5.3
Base 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X
Product Names From Source
Cisco Unified Computing System (Managed), Cisco Firepower Extensible Operating System (FXOS) 2.0.1.68, Cisco Firepower Extensible Operating System (FXOS)

Related Products

Product CVE Evidence
Firepower Extensible Operating System CVE-2017-6600 Cisco OpenVuln
Cisco Unified Computing System (Managed) CVE-2017-6600 Cisco OpenVuln
Cisco Firepower Extensible Operating System (FXOS) CVE-2017-6600 Cisco OpenVuln
Cisco Firepower Extensible Operating System CVE-2017-6600 Cisco OpenVuln
Cisco Firepower 4100 Series CVE-2017-6600 Cisco OpenVuln