Sign-up

ID

VAR-201708-1335


CVE

CVE-2017-6781


TITLE

Cisco Policy Suite Vulnerability related to authorization, authority, and access control in software

Trust: 0.8

sources: JVNDB: JVNDB-2017-007253

DESCRIPTION

A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker to gain elevated privileges on an affected system. The affected privilege level is not at the root level. The vulnerability is due to incorrect role-based access control (RBAC) for shell user accounts. An attacker could exploit this vulnerability by authenticating to an affected appliance and providing crafted user input via the CLI. A successful exploit could allow the attacker to acquire a higher privilege level than should have been granted. To exploit this vulnerability, the attacker must log in to the appliance with valid credentials. Cisco Bug IDs: CSCve37724. Known Affected Releases: 9.0.0, 9.1.0, 10.0.0, 11.0.0, 12.0.0. Vendors have confirmed this vulnerability Bug ID CSCve37724 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Local attackers may exploit this issue to gain elevated privileges. The software provides functions such as user-based business rules, real-time management of applications and network resources

Trust: 1.98

sources: NVD: CVE-2017-6781 // JVNDB: JVNDB-2017-007253 // BID: 100365 // VULHUB: VHN-114984

AFFECTED PRODUCTS

vendor:ciscomodel:policy suitescope:eqversion:9.1.0

Trust: 1.6

vendor:ciscomodel:policy suitescope:eqversion:9.0.0

Trust: 1.6

vendor:ciscomodel:policy suitescope:eqversion:10.0.0

Trust: 1.6

vendor:ciscomodel:policy suitescope:eqversion:12.0.0

Trust: 1.6

vendor:ciscomodel:policy suitescope:eqversion:11.0.0

Trust: 1.6

vendor:ciscomodel:policy suitescope: - version: -

Trust: 0.8

vendor:ciscomodel:policy suite softwarescope:eqversion:0

Trust: 0.3

vendor:ciscomodel:mobility services enginescope:eqversion:12.0

Trust: 0.3

vendor:ciscomodel:mobility services enginescope:eqversion:11.0

Trust: 0.3

vendor:ciscomodel:mobility services enginescope:eqversion:10.0

Trust: 0.3

vendor:ciscomodel:mobility services enginescope:eqversion:9.1

Trust: 0.3

vendor:ciscomodel:mobility services enginescope:eqversion:9.0

Trust: 0.3

sources: BID: 100365 // JVNDB: JVNDB-2017-007253 // CNNVD: CNNVD-201708-720 // NVD: CVE-2017-6781

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6781
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-6781
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201708-720
value: MEDIUM

Trust: 0.6

VULHUB: VHN-114984
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-6781
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-114984
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-6781
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 1.8
impactScore: 3.4
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-114984 // JVNDB: JVNDB-2017-007253 // CNNVD: CNNVD-201708-720 // NVD: CVE-2017-6781

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.1

problemtype:CWE-264

Trust: 0.9

sources: VULHUB: VHN-114984 // JVNDB: JVNDB-2017-007253 // NVD: CVE-2017-6781

THREAT TYPE

local

Trust: 0.9

sources: BID: 100365 // CNNVD: CNNVD-201708-720

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201708-720

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-007253

PATCH
title:cisco-sa-20170816-cpsurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-cps
Trust: 0.8
title:Cisco Policy Suite Software Fixes for permission permissions and access control vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74071
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-007253 // 
            
            
            
            CNNVD: CNNVD-201708-720

EXTERNAL IDS
db:NVDid:CVE-2017-6781
Trust: 2.8
db:BIDid:100365
Trust: 2.0
db:JVNDBid:JVNDB-2017-007253
Trust: 0.8
db:CNNVDid:CNNVD-201708-720
Trust: 0.7
db:VULHUBid:VHN-114984
Trust: 0.1
sources:
            
            
            VULHUB: VHN-114984 // 
            
            
            
            BID: 100365 // 
            
            
            
            JVNDB: JVNDB-2017-007253 // 
            
            
            
            CNNVD: CNNVD-201708-720 // 
            
            
            
            NVD: CVE-2017-6781

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170816-cps
Trust: 2.0
url:http://www.securityfocus.com/bid/100365
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6781
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-6781
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-114984 // 
            
            
            
            BID: 100365 // 
            
            
            
            JVNDB: JVNDB-2017-007253 // 
            
            
            
            CNNVD: CNNVD-201708-720 // 
            
            
            
            NVD: CVE-2017-6781

CREDITS
Cisco.
Trust: 0.9
sources:
            
            
            BID: 100365 // 
            
            
            
            CNNVD: CNNVD-201708-720

SOURCES
db:VULHUBid:VHN-114984
db:BIDid:100365
db:JVNDBid:JVNDB-2017-007253
db:CNNVDid:CNNVD-201708-720
db:NVDid:CVE-2017-6781

LAST UPDATE DATE
2025-04-20T23:19:52.549000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-114984date:2019-10-03T00:00:00
db:BIDid:100365date:2017-08-16T00:00:00
db:JVNDBid:JVNDB-2017-007253date:2017-09-14T00:00:00
db:CNNVDid:CNNVD-201708-720date:2019-10-23T00:00:00
db:NVDid:CVE-2017-6781date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:VULHUBid:VHN-114984date:2017-08-17T00:00:00
db:BIDid:100365date:2017-08-16T00:00:00
db:JVNDBid:JVNDB-2017-007253date:2017-09-14T00:00:00
db:CNNVDid:CNNVD-201708-720date:2017-08-17T00:00:00
db:NVDid:CVE-2017-6781date:2017-08-17T20:29:00.713