PT-2017-17268 · Autoit+1 · Autoit+1

Published 2017-07-06 · Updated 2019-10-09 · CVE-2017-6714

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Ultra Services Framework Staging Server versions prior to 5.0.3 Cisco Ultra Services Framework Staging Server versions prior to 5.1

Description A vulnerability in the AutoIT service could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The issue is due to improper shell invocations. An attacker could exploit this by crafting CLI command inputs to execute Linux shell commands as the root user.

Recommendations For versions prior to 5.0.3, update to Release 5.0.3 or later. For versions prior to 5.1, update to Release 5.1 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-6714

Affected Products

Autoit

Cisco Ultra Services Framework Staging Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6714 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6714 · Vendor Advisory
• http://securityfocus.com/bid/99436 · Note