CVE-2017-6597 Command injection in Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance

High 7.8 Published 7 Apr 2017 Updated 5 Aug 2024

An authenticated local attacker can execute arbitrary commands via the local-mgmt CLI in Cisco UCS Manager and Firepower appliances.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-6597?

CVE-2017-6597 is a high-severity command injection vulnerability in Cisco Firepower Extensible Operating System, published on 7 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the local-mgmt CLI command of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to perform a command injection attack. More Information: CSCvb61394 CSCvb86816. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1658) 2.0(1.115).

Weakness: CWE-78

Which versions are affected by CVE-2017-6597?

It affects 2 products.

Products include Cisco Firepower Extensible Operating System, Cisco Unified Computing System.

How do I fix CVE-2017-6597?

No fix has been published for CVE-2017-6597 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2017-6597 being exploited?

There is no known exploitation of CVE-2017-6597 in the wild and no public exploit code.

All Cisco Firepower Extensible Operating System vulnerabilities

Sources

Also known as GHSA-px2w-fvgw-7j9q.