Sign-up

ID

VAR-201709-1175


CVE

CVE-2017-6796


TITLE

Cisco ASR 920 Operates on the Series Aggregation Service Router Cisco IOS XE In OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-007991

DESCRIPTION

A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the platform usb modem command in the CLI of the affected software. An attacker could exploit this vulnerability by modifying the platform usb modem command in the CLI of an affected device. A successful exploit could allow the attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. Cisco Bug IDs: CSCve48949. Vendors have confirmed this vulnerability Bug ID CSCve48949 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Cisco ASR920 Series Aggregation Services Routers is the ASR920 series of multi-function routers from Cisco. Cisco IOSXESoftware is one of the operating systems dedicated to network devices. The IOSXESoftware USB-modem code in Cisco ASR920 Series AggregationServicesRouters has an arbitrary command execution vulnerability that stems from a program failing to perform input validation correctly. Failed attempts may lead to denial-of-service conditions

Trust: 2.61

sources: NVD: CVE-2017-6796 // JVNDB: JVNDB-2017-007991 // CNVD: CNVD-2017-32519 // BID: 100647 // VULHUB: VHN-114999 // VULMON: CVE-2017-6796

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-32519

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion: -

Trust: 1.6

vendor:ciscomodel:ios xe softwarescope:eqversion:0

Trust: 0.9

vendor:ciscomodel:asr series aggregation services router 15.6 sscope:eqversion:920

Trust: 0.9

vendor:ciscomodel:ios xescope: - version: -

Trust: 0.8

vendor:ciscomodel:asr series aggregation services routerscope:neversion:92016.7(0.94)

Trust: 0.3

sources: CNVD: CNVD-2017-32519 // BID: 100647 // JVNDB: JVNDB-2017-007991 // CNNVD: CNNVD-201703-525 // NVD: CVE-2017-6796

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6796
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-6796
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-32519
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201703-525
value: MEDIUM

Trust: 0.6

VULHUB: VHN-114999
value: HIGH

Trust: 0.1

VULMON: CVE-2017-6796
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-6796
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2017-32519
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-114999
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-6796
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2017-32519 // VULHUB: VHN-114999 // VULMON: CVE-2017-6796 // JVNDB: JVNDB-2017-007991 // CNNVD: CNNVD-201703-525 // NVD: CVE-2017-6796

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.9

sources: VULHUB: VHN-114999 // JVNDB: JVNDB-2017-007991 // NVD: CVE-2017-6796

THREAT TYPE

local

Trust: 0.9

sources: BID: 100647 // CNNVD: CNNVD-201703-525

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201703-525

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-007991

PATCH
title:cisco-sa-20170906-asr920-1url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-asr920-1
Trust: 0.8
title:Cisco IOSXESoftware Command Execution Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/104301
Trust: 0.6
title:Cisco ASR 920 Series Aggregation Services Routers IOS XE Software Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99677
Trust: 0.6
title:Cisco: Cisco IOS XE Software for Cisco ASR 920 Series Routers Arbitrary Command Execution Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20170906-asr920-1
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-32519 // 
            
            
            
            VULMON: CVE-2017-6796 // 
            
            
            
            JVNDB: JVNDB-2017-007991 // 
            
            
            
            CNNVD: CNNVD-201703-525

EXTERNAL IDS
db:NVDid:CVE-2017-6796
Trust: 3.5
db:BIDid:100647
Trust: 2.7
db:SECTRACKid:1039281
Trust: 1.8
db:JVNDBid:JVNDB-2017-007991
Trust: 0.8
db:CNNVDid:CNNVD-201703-525
Trust: 0.7
db:CNVDid:CNVD-2017-32519
Trust: 0.6
db:VULHUBid:VHN-114999
Trust: 0.1
db:VULMONid:CVE-2017-6796
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-32519 // 
            
            
            
            VULHUB: VHN-114999 // 
            
            
            
            VULMON: CVE-2017-6796 // 
            
            
            
            BID: 100647 // 
            
            
            
            JVNDB: JVNDB-2017-007991 // 
            
            
            
            CNNVD: CNNVD-201703-525 // 
            
            
            
            NVD: CVE-2017-6796

REFERENCES
url:http://www.securityfocus.com/bid/100647
Trust: 2.5
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170906-asr920-1
Trust: 2.2
url:http://www.securitytracker.com/id/1039281
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-6796
Trust: 1.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6796
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/78.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-32519 // 
            
            
            
            VULHUB: VHN-114999 // 
            
            
            
            VULMON: CVE-2017-6796 // 
            
            
            
            BID: 100647 // 
            
            
            
            JVNDB: JVNDB-2017-007991 // 
            
            
            
            CNNVD: CNNVD-201703-525 // 
            
            
            
            NVD: CVE-2017-6796

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 100647

SOURCES
db:CNVDid:CNVD-2017-32519
db:VULHUBid:VHN-114999
db:VULMONid:CVE-2017-6796
db:BIDid:100647
db:JVNDBid:JVNDB-2017-007991
db:CNNVDid:CNNVD-201703-525
db:NVDid:CVE-2017-6796

LAST UPDATE DATE
2024-11-23T23:12:23.043000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-32519date:2017-11-02T00:00:00
db:VULHUBid:VHN-114999date:2019-10-09T00:00:00
db:VULMONid:CVE-2017-6796date:2019-10-09T00:00:00
db:BIDid:100647date:2017-09-06T00:00:00
db:JVNDBid:JVNDB-2017-007991date:2017-10-05T00:00:00
db:CNNVDid:CNNVD-201703-525date:2019-10-17T00:00:00
db:NVDid:CVE-2017-6796date:2024-11-21T03:30:32.827

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-32519date:2017-11-02T00:00:00
db:VULHUBid:VHN-114999date:2017-09-07T00:00:00
db:VULMONid:CVE-2017-6796date:2017-09-07T00:00:00
db:BIDid:100647date:2017-09-06T00:00:00
db:JVNDBid:JVNDB-2017-007991date:2017-10-05T00:00:00
db:CNNVDid:CNNVD-201703-525date:2017-03-14T00:00:00
db:NVDid:CVE-2017-6796date:2017-09-07T21:29:01.007