Auth bypass in Cisco Ultra Services Framework
CVE-2017-6711
A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device. The vulnerability is due to an insecure default configuration of the Apache ZooKeeper service used by the affected software. An attacker could exploit this vulnerability by accessing the affected device through the orchestrator network. An exploit could allow the attacker to gain access to ZooKeeper data nodes (znodes) and influence the behavior of the system's high-availability feature. This vulnerability affects all releases of Cisco Ultra Services Framework UAS prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvd29395.
Vulnerability class: Broken Authentication
EPSS: 0.016 (72.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Cisco Ultra_services_framework
- N/a Cisco Ultra Services Framework — versions Cisco Ultra Services Framework
Weakness classification (CWE)
References
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-6711?
- CVE-2017-6711 is a critical-severity vulnerability in Cisco Ultra Services Framework, classified under Improper Authentication. CVSS score: 9.1/10. Published 2017-07-06.
- How severe is CVE-2017-6711?
- Critical severity. CVSS v3 base score is 9.1 out of 10.