CVE-2017-6750

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to log in to the device with the privileges of a limited user or an unauthenticated, remote attacker to authenticate to certain areas of the web GUI, aka a Static Credentials Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCve06124. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270.

Una vulnerabilidad en AsyncOS para Web Security Appliance (WSA) de Cisco, podría permitir a un atacante local no autenticado iniciar sesión en el dispositivo con los privilegios de un usuario limitado o un atacante remoto no autenticado para autenticarse en ciertas áreas de la GUI basada en web, también se conoce como Vulnerabilidad de Credenciales Estáticas. Productos afectados: versiones virtuales y de hardware de Web Security Appliance (WSA) de Cisco. Más información: CSCve06124. Versiones afectadas conocidas: 10.1.0-204. Versiones fijas conocidas: 10.5.1-270.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-03-09 CVE Reserved
2017-07-25 CVE Published
2023-03-07 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-1188: Initialization of a Resource with an Insecure Default

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/99924	Third Party Advisory
http://www.securitytracker.com/id/1038958	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa4	2019-10-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.0.0-232 Search vendor "Cisco" for product "Web Security Appliance" and version "10.0.0-232"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.0.0-233 Search vendor "Cisco" for product "Web Security Appliance" and version "10.0.0-233"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.0_base Search vendor "Cisco" for product "Web Security Appliance" and version "10.0_base"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.1.0 Search vendor "Cisco" for product "Web Security Appliance" and version "10.1.0"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.1.0-204 Search vendor "Cisco" for product "Web Security Appliance" and version "10.1.0-204"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.1.1-230 Search vendor "Cisco" for product "Web Security Appliance" and version "10.1.1-230"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.1.1-234 Search vendor "Cisco" for product "Web Security Appliance" and version "10.1.1-234"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.1.1-235 Search vendor "Cisco" for product "Web Security Appliance" and version "10.1.1-235"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.5.0 Search vendor "Cisco" for product "Web Security Appliance" and version "10.5.0"		-		Affected
Cisco Search vendor "Cisco"		Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance"				10.5.0-358 Search vendor "Cisco" for product "Web Security Appliance" and version "10.5.0-358"		-		Affected
Cisco Search vendor "Cisco"		Web Security Virtual Appliance Search vendor "Cisco" for product "Web Security Virtual Appliance"				10.0.0 Search vendor "Cisco" for product "Web Security Virtual Appliance" and version "10.0.0"		-		Affected
Cisco Search vendor "Cisco"		Web Security Virtual Appliance Search vendor "Cisco" for product "Web Security Virtual Appliance"				10.0_base Search vendor "Cisco" for product "Web Security Virtual Appliance" and version "10.0_base"		-		Affected
Cisco Search vendor "Cisco"		Web Security Virtual Appliance Search vendor "Cisco" for product "Web Security Virtual Appliance"				10.1.0 Search vendor "Cisco" for product "Web Security Virtual Appliance" and version "10.1.0"		-		Affected
Cisco Search vendor "Cisco"		Web Security Virtual Appliance Search vendor "Cisco" for product "Web Security Virtual Appliance"				10.1.1 Search vendor "Cisco" for product "Web Security Virtual Appliance" and version "10.1.1"		-		Affected
Cisco Search vendor "Cisco"		Web Security Virtual Appliance Search vendor "Cisco" for product "Web Security Virtual Appliance"				10.1_base Search vendor "Cisco" for product "Web Security Virtual Appliance" and version "10.1_base"		-		Affected
Cisco Search vendor "Cisco"		Web Security Virtual Appliance Search vendor "Cisco" for product "Web Security Virtual Appliance"				10.5.1 Search vendor "Cisco" for product "Web Security Virtual Appliance" and version "10.5.1"		-		Affected
Cisco Search vendor "Cisco"		Web Security Virtual Appliance Search vendor "Cisco" for product "Web Security Virtual Appliance"				10.5_base Search vendor "Cisco" for product "Web Security Virtual Appliance" and version "10.5_base"		-		Affected