CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2017-6672
https://notcve.org/view.php?id=CVE-2017-6672
A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. More Information: CSCvb99022 CSCvc16964 CSCvc37351 CSCvc54843 CSCvc63444 CSCvc77815 CSCvc88658 CSCve08955 CSCve14141 CSCve33870. Una vulnerabilidad en ciertos mecanismos de filtrado de listas de control de acceso (ACL) para ASR 5000 Series Aggregation Services Routers hasta la versión 21.x de Cisco, podría permitir a un atacante remoto no autenticado omitir las reglas ACL que se han configurado para un dispositivo afectado. Más información: CSCvb99022 CSCvc16964 CSCvc37351 CSCvc54843 CSCvc63444 CSCvc77815 CSCvc88658 CSCve08955 CSCve14141 CSCve33870. • http://www.securityfocus.com/bid/99921 http://www.securitytracker.com/id/1038962 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-asr1 • CWE-863: Incorrect Authorization •
CVSS: 8.6EPSS: 0%CPEs: 7EXPL: 0CVE-2017-6612
https://notcve.org/view.php?id=CVE-2017-6612
A vulnerability in the gateway GPRS support node (GGSN) of Cisco ASR 5000 Series Aggregation Services Routers 17.3.9.62033 through 21.1.2 could allow an unauthenticated, remote attacker to redirect HTTP traffic sent to an affected device. More Information: CSCvc67927. Una vulnerabilidad en el nodo de soporte del gateway GPRS (GGSN) de ASR 5000 Series Aggregation Services Routers versión 17.3.9.62033 hasta 21.1.2 de Cisco, podría permitir a un atacante remoto no autenticado redireccionar el tráfico HTTP enviado hacia un dispositivo afectado. Más información: CSCvc67927. • http://www.securityfocus.com/bid/99920 http://www.securitytracker.com/id/1038961 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-asr • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 53EXPL: 0CVE-2017-6729
https://notcve.org/view.php?id=CVE-2017-6729
A vulnerability in the Border Gateway Protocol (BGP) processing functionality of the Cisco StarOS operating system for Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core (VPC) Software could allow an unauthenticated, remote attacker to cause the BGP process on an affected system to reload, resulting in a denial of service (DoS) condition. This vulnerability affects the following products if they are running the Cisco StarOS operating system and BGP is enabled for the system: Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core Software. More Information: CSCvc44968. Known Affected Releases: 16.4.1 19.1.0 21.1.0 21.1.M0.65824. Known Fixed Releases: 21.3.A0.65902 21.2.A0.65905 21.1.b0.66164 21.1.V0.66014 21.1.R0.65898 21.1.M0.65894 21.1.0.66030 21.1.0. • http://www.securityfocus.com/bid/100015 http://www.securitytracker.com/id/1038819 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-staros •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6690
https://notcve.org/view.php?id=CVE-2017-6690
A vulnerability in the file check operation of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify arbitrary files on an affected system. More Information: CSCvd73726. Known Affected Releases: 21.0.v0.65839 21.3.M0.67005. Known Fixed Releases: 21.4.A0.67087 21.4.A0.67079 21.4.A0.67013 21.3.M0.67084 21.3.M0.67077 21.3.M0.66994 21.3.J0.66993 21.1.v0.67082 21.1.V0.67083. Una vulnerabilidad en la operación de comprobación de archivos de Enrutadores ASR 5000 Series Aggregated Services de Cisco, que ejecutan el sistema operativo StarOS de Cisco, podría permitir a un atacante remoto autenticado sobrescribir o modificar los archivos arbitrarios en un sistema afectado. • http://www.securityfocus.com/bid/98998 http://www.securitytracker.com/id/1038634 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-staros • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 24EXPL: 0CVE-2017-3819
https://notcve.org/view.php?id=CVE-2017-3819
A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root shell access. The vulnerability is due to missing input validation of parameters passed during SSH or SFTP login. An attacker could exploit this vulnerability by providing crafted user input to the SSH or SFTP command-line interface (CLI) during SSH or SFTP login. An exploit could allow an authenticated attacker to gain root privileges access on the router. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. • http://www.securityfocus.com/bid/96913 http://www.securitytracker.com/id/1038050 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr • CWE-264: Permissions, Privileges, and Access Controls CWE-306: Missing Authentication for Critical Function •