Vulnerability Name:

CVE-2017-6690 (CCN-126913)

Assigned:2017-06-07
Published:2017-06-07
Updated:2019-10-03
Summary:A vulnerability in the file check operation of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify arbitrary files on an affected system. More Information: CSCvd73726. Known Affected Releases: 21.0.v0.65839 21.3.M0.67005. Known Fixed Releases: 21.4.A0.67087 21.4.A0.67079 21.4.A0.67013 21.3.M0.67084 21.3.M0.67077 21.3.M0.66994 21.3.J0.66993 21.1.v0.67082 21.1.V0.67083.
CVSS v3 Severity:4.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
4.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
4.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N)
3.6 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-20
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2017-6690

Source: BID
Type: Third Party Advisory, VDB Entry
98998

Source: CCN
Type: BID-98998
Cisco StarOS CVE-2017-6690 Remote Security Bypass Vulnerability

Source: SECTRACK
Type: UNKNOWN
1038634

Source: XF
Type: UNKNOWN
cisco-cve20176690-file-overwrite(126913)

Source: CCN
Type: Cisco Security Advisory cisco-sa-20170607-staros
Cisco StarOS Arbitrary File Modification Vulnerability

Source: CONFIRM
Type: Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-staros

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cisco:asr_5000_software:21.0.v0.65839:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:asr_5000_software:21.3.m0.67005:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:asr_5000:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:cisco:asr_5000_series:16.4.1:*:*:*:*:*:*:*
  • OR cpe:/o:cisco:staros:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco asr 5000 software 21.0.v0.65839
    cisco asr 5000 software 21.3.m0.67005
    cisco asr 5000 -
    cisco asr 5000 series 16.4.1
    cisco staros *