Vulnerability Details : CVE-2017-6664
A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to access the Autonomic Networking infrastructure of an affected system, after the certificate for the autonomic node has been revoked. This vulnerability affected devices that are running Release 16.x of Cisco IOS XE Software and are configured to use Autonomic Networking. This vulnerability does not affect devices that are running an earlier release of Cisco IOS XE Software or devices that are not configured to use Autonomic Networking. More Information: CSCvd22328. Known Affected Releases: 15.5(1)S3.1 Denali-16.2.1.
Products affected by CVE-2017-6664
- cpe:2.3:o:cisco:ios_xe:3.13.5s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.16.2s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.17.1s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.17.0s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.16.2as:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.15.1s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.14.2s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.12.3s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.13.2s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.12.0s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.13.1s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.12.4s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.16.0s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.14.4s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.14.3s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.15.0s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.14.0s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.15.3s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.16.1as:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.13.4s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.15.2s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.14.1s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.12.2s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.12.1s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.18.0s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:16.5.1c:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.10.8as:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:3.10.8s:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-6664
0.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-6664
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-6664
-
The product does not validate, or incorrectly validates, a certificate.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-6664
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170726-anicrl
Cisco IOS XE Software Autonomic Networking Infrastructure Certificate Revocation VulnerabilityVendor Advisory
-
http://www.securityfocus.com/bid/99986
Cisco IOS XE Software CVE-2017-6664 Certificate Validation Security Bypass VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1038997
Cisco IOS/IOS XE Autonomic Networking Validation Flaw Lets Remote Users Bypass the Certificate Revocation List - SecurityTrackerThird Party Advisory;VDB Entry
Jump to