VULNERABILITY INTELLIGENCE

CVE-2017-6714

CVSS score9.8 CRITICAL

EPSS probability4.20%

CISA KEVNot currently listed

Published2017-07-06

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The vulnerability is due to improper shell invocations. An attacker could exploit this vulnerability by crafting CLI command inputs to execute Linux shell commands as the root user. This vulnerability affects all releases of Cisco Ultra Services Framework Staging Server prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76673.

Weakness classification

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references

psirt@cisco.com — Third Party Advisory, VDB Entry
psirt@cisco.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory