Vulnerability Details : CVE-2017-6639
A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system. The vulnerability is due to the lack of authentication and authorization mechanisms for a debugging tool that was inadvertently enabled in the affected software. An attacker could exploit this vulnerability by remotely connecting to the debugging tool via TCP. A successful exploit could allow the attacker to access sensitive information about the affected software or execute arbitrary code with root privileges on the affected system. This vulnerability affects Cisco Prime Data Center Network Manager (DCNM) Software Releases 10.1(1) and 10.1(2) for Microsoft Windows, Linux, and Virtual Appliance platforms. Cisco Bug IDs: CSCvd09961.
Vulnerability category: Execute code
Products affected by CVE-2017-6639
- cpe:2.3:a:cisco:prime_data_center_network_manager:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:prime_data_center_network_manager:10.1\(2\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:prime_data_center_network_manager:10.1\(1\):*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-6639
33.81%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-6639
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2017-6639
-
Assigned by: ykramarz@cisco.com (Secondary)
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-6639
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm1
Cisco Prime Data Center Network Manager Debug Remote Code Execution VulnerabilityVendor Advisory
-
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesb3p03762en_us
HPESB3P03762 rev.1 - HPE C Switch Software using Cisco Prime Data Center Network Manager (DCNM), Remote Code Execution
-
http://www.securitytracker.com/id/1038626
Cisco Prime Data Center Network Manager Debugging Tool Lets Remote Users Execute Arbitrary Code on the Target System - SecurityTracker
-
http://www.securityfocus.com/bid/98935
Cisco Prime Data Center Network Manager CVE-2017-6639 Remote Code Execution VulnerabilityThird Party Advisory;VDB Entry
Jump to