PT-2017-2633 · Cisco · Cisco Prime Data Center Network Manager
Publicado
2017-06-08
·
Atualizado
2019-10-03
·
CVE-2017-6639
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Prime Data Center Network Manager (DCNM) versions 10.1(1) through 10.1(2)
Description
A vulnerability in the role-based access control (RBAC) functionality could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system. The issue is due to the lack of authentication and authorization mechanisms for a debugging tool that was inadvertently enabled in the affected software. An attacker could exploit this by remotely connecting to the debugging tool via TCP, potentially accessing sensitive information or executing arbitrary code with root privileges.
Recommendations
For versions 10.1(1) and 10.1(2), consider disabling the debugging tool until a patch is available to prevent exploitation.
Restrict access to the debugging tool to minimize the risk of exploitation.
Avoid using the affected software until a fixed version is released.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Authorization
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Prime Data Center Network Manager