CVE-2017-6598 Privilege escalation in Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance
An authenticated local attacker can execute arbitrary commands via the debug plug-in, leading to privilege escalation on Cisco UCS and Firepower devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6598?
CVE-2017-6598 is a medium-severity vulnerability in Cisco Firepower Extensible Operating System, published on 7 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the debug plug-in functionality of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to execute arbitrary commands, aka Privilege Escalation. More Information: CSCvb86725 CSCvb86797. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.105) 92.1(1.1733) 2.1(1.69).
Weakness: CWE-862
Which versions are affected by CVE-2017-6598?
It affects 2 products.
Products include Cisco Firepower Extensible Operating System, Cisco Unified Computing System.
How do I fix CVE-2017-6598?
No fix has been published for CVE-2017-6598 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-6598 being exploited?
There is no known exploitation of CVE-2017-6598 in the wild and no public exploit code.
Other vulnerabilities in Cisco Firepower Extensible Operating System
- CVE-2018-0310 Information disclosure in Cisco FXOS and NX-OS unknown
- CVE-2015-6435 Command injection in n/a
- CVE-2021-1368 Memory corruption in Cisco NX-OS Software
- CVE-2020-3456 Cisco FXOS Software Firepower Chassis Manager Cross-Site Request Forgery Vulnerability
- CVE-2020-3172 Cisco FXOS and NX-OS Software Cisco Discovery Protocol Arbitrary Code Execution and Denial of Service Vulnerability
All Cisco Firepower Extensible Operating System vulnerabilities
Sources
Also known as GHSA-p23q-35x3-74m3.