What is CVE-2017-6708?

CVE-2017-6708 is a critical-severity vulnerability in Cisco Ultra Services Framework, classified under Information Disclosure. CVSS score: 9.8/10. Published 2017-07-06.

How severe is CVE-2017-6708?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Information disclosure in Cisco Ultra Services Framework

CVE-2017-6708

A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulnerability is due to the absence of validation checks for the input that is used to create symbolic links. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76654.

Vulnerability class: Information Disclosure

EPSS: 0.015 (70.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Ultra_services_framework
N/a Cisco Ultra Services Framework — versions Cisco Ultra Services Framework

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@cisco.com (vdb-entry, x_refsource_BID)
psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-6708?: CVE-2017-6708 is a critical-severity vulnerability in Cisco Ultra Services Framework, classified under Information Disclosure. CVSS score: 9.8/10. Published 2017-07-06.
How severe is CVE-2017-6708?: Critical severity. CVSS v3 base score is 9.8 out of 10.