Vulnerability Name:

CVE-2017-6600 (CCN-124186)

Assigned:2017-04-05
Published:2017-04-05
Updated:2019-10-03
Summary:A vulnerability in the CLI of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. More Information: CSCvb61351 CSCvb61637. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1645) 2.0(1.82) 1.1(4.136.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
4.3 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-78
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2017-6600

Source: BID
Type: Third Party Advisory, VDB Entry
97439

Source: CCN
Type: BID-97439
Multiple Cisco Products CVE-2017-6600 Local Command Injection Vulnerability

Source: SECTRACK
Type: UNKNOWN
1038199

Source: XF
Type: UNKNOWN
cisco-cve20176600-command-exec(124186)

Source: CCN
Type: Cisco Security Advisory cisco-sa-20170405-ucs1
Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance CLI Command Injection Vulnerability

Source: CONFIRM
Type: Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucs1

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cisco:firepower_extensible_operating_system:2.0(1.68):*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unified_computing_system:3.1(1k)a:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/h:cisco:unified_computing_system_manager:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:firepower_9300_security_appliance:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco firepower extensible operating system 2.0(1.68)
    cisco unified computing system 3.1(1k)a
    cisco unified computing system manager -
    cisco firepower 9300 security appliance -