PT-2017-1791 · Cisco · Cisco Unified Computing System (Ucs) Manager+2

Published 2017-04-07 · Updated 2019-10-03 · CVE-2017-6600

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System (UCS) Manager versions prior to 2.0(1.82) Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) versions prior to 2.0(1.82) Cisco Firepower 9300 Security Appliance versions prior to 2.0(1.82)

Description A vulnerability in the CLI of the affected systems could allow an authenticated, local attacker to perform a command injection attack due to the lack of input validation. This could enable the attacker to inject arbitrary commands.

Recommendations For Cisco Unified Computing System (UCS) Manager version 2.0(1.68), update to version 2.0(1.82) or later. For Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) version 3.1(1k)A, update to version 92.2(1.101) or later. For Cisco Firepower 9300 Security Appliance version 1.1(4.136), update to version 92.1(1.1645) or later. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2017-00947

CVE-2017-6600

Affected Products

Cisco Firepower 4100 Series Next-Generation Firewall

Cisco Firepower 9300 Security Appliance

Cisco Unified Computing System (Ucs) Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-6600 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucs1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6600 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00947 · Security Note
• http://securitytracker.com/id/1038199 · Note
• http://securityfocus.com/bid/97439 · Note