CVE-2017-6774

Severity Score

5.0

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify sensitive system files. The vulnerability is due to the inclusion of sensitive system files within specific FTP subdirectories. An attacker could exploit this vulnerability by overwriting sensitive configuration files through FTP. An exploit could allow the attacker to overwrite configuration files on an affected system. Cisco Bug IDs: CSCvd47739. Known Affected Releases: 21.0.v0.65839.

Una vulnerabilidad en Cisco ASR 5000 Series Aggregated Services Routers ejecutando el sistema operativo Cisco StarOS podría permitir que un atacante remoto autenticado sobrescriba o modifique archivos del sistema sensibles. Esta vulnerabilidad se debe a la inclusión de archivos sensibles del sistema en subdirectorios FTP específicos. Un atacante podría explotar esta vulnerabilidad sobrescribiendo archivos de configuración sensibles mediante FTP. Un exploit podría permitir que un atacante sobrescribiese archivos de configuración en un sistema afectado. Cisco Bug IDs: CSCvd47739. Versiones afectadas conocidas: 21.0.v0.65839.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-03-09 CVE Reserved
2017-08-17 CVE Published
2023-03-08 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-552: Files or Directories Accessible to External Parties

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/100386	Third Party Advisory
http://www.securitytracker.com/id/1039182	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-staros2	2019-10-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Asr 5000 Software Search vendor "Cisco" for product "Asr 5000 Software"				21.0.v0.65839 Search vendor "Cisco" for product "Asr 5000 Software" and version "21.0.v0.65839"		-		Affected