PT-2017-17264 · Cisco · Cisco Virtual Network Function Element Manager

Published 2017-08-17 · Updated 2017-08-25 · CVE-2017-6710

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Virtual Network Function (VNF) Element Manager versions prior to 5.0.4 and 5.1.4

Description A vulnerability in the Cisco Virtual Network Function (VNF) Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. This issue arises from command settings that permit users to specify arbitrary commands to run as root on the server, which an attacker could exploit to elevate privileges.

Recommendations For versions prior to 5.0.4, update to version 5.0.4 or later to resolve the issue. For versions prior to 5.1.4, update to version 5.1.4 or later to resolve the issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-6710

Affected Products

Cisco Virtual Network Function Element Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6710 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6710 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-em · Vendor Advisory
• http://securityfocus.com/bid/100362 · Note