CVE-2017-6079 : The HTTP web-management application on Edgewater Networks Edgemarc appliances ha

The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side from the web application: if the command is valid, it executes. An example is the wget command. The page that allows this has been confirmed in firmware as old as 2006.

Published 2017-05-16 17:29:00

Updated 2021-09-13 11:20:36

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-6079

Ribboncommunications » Edgemarc Firmware » Version: N/A
cpe:2.3:o:ribboncommunications:edgemarc_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Ribboncommunications » Edgemarc 4550 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 4552 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 4601 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 4700 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 4750 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 4800 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 4806 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 4808 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 7301 » Version: N/A
When used together with: Ribboncommunications » Edgemarc 7400 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-6079

EPSS FAQ

0.72%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-6079

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2017-6079

https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices

CVE-2017-6079 – Blind Command Injection in Edgewater Edgemarc Devices
Exploit;Technical Description;Third Party Advisory

Jump to

Vulnerability Details : CVE-2017-6079

Products affected by CVE-2017-6079

Exploit prediction scoring system (EPSS) score for CVE-2017-6079

CVSS scores for CVE-2017-6079

References for CVE-2017-6079