What is CVE-2017-6672?

CVE-2017-6672 is a high-severity vulnerability in Cisco Asr 5000 Series Software, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2017-07-25.

How severe is CVE-2017-6672?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Cisco Asr 5000 Series Software

CVE-2017-6672

A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. More Information: CSCvb99022 CSCvc16964 CSCvc37351 CSCvc54843 CSCvc63444 CSCvc77815 CSCvc88658 CSCve08955 CSCve14141 CSCve33870.

Vulnerability class: Broken Access Control

EPSS: 0.018 (77.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Cisco Asr_5000_series_software — versions 19.3.5, 19.3.11, 19.3.12
N/a Cisco Asr 5000 Series Aggregation Services Routers — versions Cisco ASR 5000 Series Aggregation Services Routers

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)

Frequently asked questions

What is CVE-2017-6672?: CVE-2017-6672 is a high-severity vulnerability in Cisco Asr 5000 Series Software, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2017-07-25.
How severe is CVE-2017-6672?: High severity. CVSS v3 base score is 7.5 out of 10.