What is CVE-2017-3867?

CVE-2017-3867 is a medium-severity vulnerability in Cisco Adaptive Security Appliance Software, classified under Improper Authentication. CVSS score: 5.3/10. Published 2017-03-17.

How severe is CVE-2017-3867?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Cisco Adaptive Security Appliance Software

CVE-2017-3867

A vulnerability in the Border Gateway Protocol (BGP) Bidirectional Forwarding Detection (BFD) implementation of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to bypass the access control list (ACL) for specific TCP and UDP traffic. More Information: CSCvc68229. Known Affected Releases: 9.6(2). Known Fixed Releases: 99.1(20.1) 99.1(10.2) 98.1(12.7) 98.1(1.49) 97.1(6.58) 97.1(0.134) 96.2(0.109) 9.7(1.1) 9.6(2.99) 9.6(2.8).

Vulnerability class: Broken Authentication

EPSS: 0.014 (70.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Cisco Adaptive_security_appliance_software — versions 6.3.1, 9.6.2, 9.6.2.1
N/a Cisco Adaptive Security Appliance — versions Cisco Adaptive Security Appliance

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
psirt@cisco.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2017-3867?: CVE-2017-3867 is a medium-severity vulnerability in Cisco Adaptive Security Appliance Software, classified under Improper Authentication. CVSS score: 5.3/10. Published 2017-03-17.
How severe is CVE-2017-3867?: Medium severity. CVSS v3 base score is 5.3 out of 10.