Improper input validation in Cisco Asr 5000
CVE-2017-6690
A vulnerability in the file check operation of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify arbitrary files on an affected system. More Information: CSCvd73726. Known Affected Releases: 21.0.v0.65839 21.3.M0.67005. Known Fixed Releases: 21.4.A0.67087 21.4.A0.67079 21.4.A0.67013 21.3.M0.67084 21.3.M0.67077 21.3.M0.66994 21.3.J0.66993 21.1.v0.67082 21.1.V0.67083.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.013 (68.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Cisco Asr_5000
- Cisco Asr_5000_software — versions 21.0.v0.65839, 21.3.m0.67005
- N/a Cisco Staros — versions Cisco StarOS
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2017-6690?
- CVE-2017-6690 is a medium-severity vulnerability in Cisco Asr 5000, classified under Improper Input Validation. CVSS score: 4.9/10. Published 2017-06-13.
- How severe is CVE-2017-6690?
- Medium severity. CVSS v3 base score is 4.9 out of 10.