Auth bypass in Cisco Asr 5000 Series Software
CVE-2017-6672
A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. More Information: CSCvb99022 CSCvc16964 CSCvc37351 CSCvc54843 CSCvc63444 CSCvc77815 CSCvc88658 CSCve08955 CSCve14141 CSCve33870.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.018 (78.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 78.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.018 · change: +0.001
Affected products
- Cisco Asr 5000 Series Software — versions 19.3.5, 19.3.11, 19.3.12
- Cisco Asr 5000 Series Aggregation Services Routers — versions Cisco ASR 5000 Series Aggregation Services Routers
Weakness classification (CWE)
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719… (Vendor Advisory)
- www.securityfocus.com/bid/99921 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securitytracker.com/id/1038962 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2017-6672?
- CVE-2017-6672 is a high-severity vulnerability in Cisco Asr 5000 Series Software, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2017-07-25.
- How severe is CVE-2017-6672?
- High severity. CVSS v3 base score is 7.5 out of 10.