PT-2017-17310 · Cisco · Cisco Asr 5000 Series Aggregated Services Routers

Published 2017-08-17 · Updated 2019-10-03 · CVE-2017-6774

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco ASR 5000 Series Aggregated Services Routers version 21.0.v0.65839

Description A vulnerability could allow an authenticated, remote attacker to overwrite or modify sensitive system files due to the inclusion of these files within specific FTP subdirectories. An attacker could exploit this by overwriting sensitive configuration files through FTP, potentially allowing them to modify configuration files on an affected system.

Recommendations For version 21.0.v0.65839, consider restricting FTP access to sensitive system files as a temporary workaround until a patch is available. Restrict access to the FTP subdirectories containing sensitive system files to minimize the risk of exploitation.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2017-6774

Affected Products

Cisco Asr 5000 Series Aggregated Services Routers

References · 5

• https://osv.dev/vulnerability/CVE-2017-6774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6774 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-staros2 · Vendor Advisory
• http://securityfocus.com/bid/100386 · Note
• http://securitytracker.com/id/1039182 · Note