CVE-2017-3791 Auth bypass in Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1
Unauthenticated remote attackers can bypass authentication in Cisco Prime Home to execute actions with administrator privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3791?
CVE-2017-3791 is a critical authentication bypass vulnerability in Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1, published on 1 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges. This vulnerability affects Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCvb49837.
Weakness: CWE-287
Which versions are affected by CVE-2017-3791?
It affects 1 product.
Products include Cisco Cisco Prime Home.
How do I fix CVE-2017-3791?
No fix has been published for CVE-2017-3791 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-3791 being exploited?
There is no known exploitation of CVE-2017-3791 in the wild and no public exploit code.
Sources
Also known as GHSA-f8ff-pgcp-3fr6.