CVE-2017-6714 Command injection in Cisco Ultra Services Framework
Unauthenticated remote attackers can execute arbitrary shell commands as root via improper shell invocations in the AutoIT service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6714?
CVE-2017-6714 is a critical command injection vulnerability in Cisco Ultra Services Framework, published on 6 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The vulnerability is due to improper shell invocations. An attacker could exploit this vulnerability by crafting CLI command inputs to execute Linux shell commands as the root user. This vulnerability affects all releases of Cisco Ultra Services Framework Staging Server prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76673.
Weakness: CWE-78
Which versions are affected by CVE-2017-6714?
It affects 1 product.
Products include Cisco Ultra Services Framework Staging Server.
How do I fix CVE-2017-6714?
No fix has been published for CVE-2017-6714 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-6714 being exploited?
There is no known exploitation of CVE-2017-6714 in the wild and no public exploit code.
Other vulnerabilities in Cisco Ultra Services Framework
Sources
Also known as GHSA-pch2-25gv-rxqj.