CVE-2017-6771 Information disclosure in Ultra Services Framework
Unauthenticated remote attackers can view sensitive configuration data by accessing a specific URL in the Cisco Ultra Services Framework AutoVNF tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6771?
CVE-2017-6771 is a high-severity vulnerability in Cisco Systems, Inc. Ultra Services Framework, published on 17 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the AutoVNF automation tool of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to acquire sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by browsing to a specific URL of an affected device. An exploit could allow the attacker to view sensitive configuration information about the deployment. Cisco Bug IDs: CSCvd29358. Known Affected Releases: 21.0.v0.65839.
Weakness: CWE-200
Which versions are affected by CVE-2017-6771?
It affects 1 product.
Products include Cisco Ultra Services Framework.
How do I fix CVE-2017-6771?
No fix has been published for CVE-2017-6771 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-6771 being exploited?
There is no known exploitation of CVE-2017-6771 in the wild and no public exploit code.
Other vulnerabilities in Cisco Systems, Inc. Ultra Services Framework
- CVE-2017-6708 Path traversal in Cisco Ultra Services Framework
- CVE-2017-6709 Information disclosure in Cisco Ultra Services Framework
- CVE-2017-6711 Auth bypass in Cisco Ultra Services Framework
- CVE-2017-6680 Path traversal in Cisco Ultra Services Framework
- CVE-2017-6681 Path traversal in Cisco Ultra Services Framework
Sources
Also known as GHSA-wvf3-49g5-gf8c.