Vulnerability Details : CVE-2017-6775
A vulnerability in the CLI of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, local attacker to elevate their privileges to admin-level privileges. The vulnerability is due to incorrect permissions that are given to a set of users. An attacker could exploit this vulnerability by logging in to the shell of an affected device and elevating their privileges by modifying environment variables. An exploit could allow the attacker to gain admin-level privileges and take control of the affected device. Cisco Bug IDs: CSCvd47741. Known Affected Releases: 21.0.v0.65839.
Exploit prediction scoring system (EPSS) score for CVE-2017-6775
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-6775
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST |
|
5.7
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L |
1.5
|
3.7
|
NIST |
References for CVE-2017-6775
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-staros3
Cisco StarOS for ASR 5000 Series Routers Privilege Escalation VulnerabilityVendor Advisory
-
http://www.securitytracker.com/id/1039183
Cisco StarOS for ASR 5000 Series Routers Incorrect User Permissions Let Local Users Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/100381
Cisco StarOS for ASR 5000 Series Routers CVE-2017-6775 Local Privilege Escalation VulnerabilityThird Party Advisory;VDB Entry
Products affected by CVE-2017-6775
- cpe:2.3:a:cisco:asr_5000_software:21.0.v0.65839:*:*:*:*:*:*:*