Vulnerability CVE-2017-2768

Vulnerability Name:

CVE-2017-2768 (CCN-121369)

Assigned:

2016-12-01

Published:

2017-02-01

Updated:

2017-07-25

Summary:

EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Configuration Manager (NCM) 9.4.2.x contains an Improper Authentication vulnerability that could potentially be exploited by malicious users to compromise the affected system.

CVSS v3 Severity:

9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): High Availibility (A): None

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Complete Availibility (A): None

Vulnerability Type:

CWE-287

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2017-2768

Source: CCN
Type: EMC Security Advisory ESA-2017-003
EMC Network Configuration Manager (NCM) Multiple Vulnerabilities

Source: CONFIRM
Type: Mailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/540085/30/0/threaded

Source: BID
Type: Third Party Advisory, VDB Entry
95936

Source: CCN
Type: BID-95936
EMC Smarts Network Configuration Manager CVE-2017-2768 Remote Security Bypass Vulnerability

Source: SECTRACK
Type: UNKNOWN
1037761

Source: XF
Type: UNKNOWN
emc-ncm-cve20172768-sec-bypass(121369)

Vulnerable Configuration:

Configuration 1:

cpe:/a:emc:smarts_network_configuration_manager:9.3:*:*:*:*:*:*:*

OR cpe:/a:emc:smarts_network_configuration_manager:9.4:*:*:*:*:*:*:*

OR cpe:/a:emc:smarts_network_configuration_manager:9.4.1:*:*:*:*:*:*:*

OR cpe:/a:emc:smarts_network_configuration_manager:9.4.2:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK