vulnwire
4.4med

CVE-2017-6795

A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
4.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 29%
Public exploits
0
none known

A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the platform usb modem command in the CLI of the affected software. An attacker could exploit this vulnerability by modifying the platform usb modem command in the CLI of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying operating system of an affected device. Cisco Bug IDs: CSCvf10783.

Exploit prediction (EPSS)

0.35% probability of exploitation in the next 30 days, higher than 29% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.04.4CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
NVD2.04.7AV:L/AC:M/Au:N/C:N/I:C/A:N

Affected products

  • n/a Cisco IOS XE

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds
Cisco IOS (RSS, critical only)

References

  • securityfocus.com /bid/100656 · vdb-entry, x_refsource_BID, x_transferred
  • tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-asr920-2 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1039282 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.