Cisco AsyncOS Software CVE-2017-6746 Command Injection Vulnerability
BID:99877
Info
Cisco AsyncOS Software CVE-2017-6746 Command Injection Vulnerability
| Bugtraq ID: | 99877 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-6746 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 19 2017 12:00AM |
| Updated: | Jul 19 2017 12:00AM |
| Credit: | Daniel Jensen from Security-Assessment.com |
| Vulnerable: |
Cisco Web Security Appliance (WSA) 0 Cisco AsyncOS Software 11.0 Cisco AsyncOS Software 10.5 Cisco AsyncOS Software 10.1.0-204 Cisco AsyncOS Software 10.1 Cisco AsyncOS Software 10.0 |
| Not Vulnerable: |
Cisco AsyncOS Software 10.5.1-270 Cisco AsyncOS Software 10.1.1-235 |
Discussion
Cisco AsyncOS Software CVE-2017-6746 Command Injection Vulnerability
Cisco AsyncOS Software for Web Security Appliance (WSA) is prone to a remote command-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary commands on the affected system with root privileges. This may aid in further attacks.
This issue is being tracked by Cisco bug ID CSCvd88862.
Cisco AsyncOS Software for Web Security Appliance (WSA) is prone to a remote command-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary commands on the affected system with root privileges. This may aid in further attacks.
This issue is being tracked by Cisco bug ID CSCvd88862.
Exploit / POC
Cisco AsyncOS Software CVE-2017-6746 Command Injection Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Cisco AsyncOS Software CVE-2017-6746 Command Injection Vulnerability
References:
References: