PT-2017-17187 · Cisco · Cisco Integrated Management Controller

Publicado 2017-04-20 · Atualizado 2019-10-09 · CVE-2017-6616

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller (IMC) version 3.0(1c)

Description A vulnerability in the web-based GUI could allow an authenticated, remote attacker to execute arbitrary code on an affected system. The issue exists because the software does not sufficiently sanitize specific values received as part of a user-supplied HTTP request. An attacker could exploit this by sending a crafted HTTP request. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the user on the affected system.

Recommendations For Cisco Integrated Management Controller (IMC) version 3.0(1c), update the software to a version that includes the fix for Cisco Bug ID: CSCvd14578.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6616

Produtos afetados

Cisco Integrated Management Controller

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-6616 · Aviso do Fabricante
• http://securityfocus.com/bid/97928 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6616 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc3 · Aviso do Fabricante