CVE-2017-3791
published 2017-02-01CVE-2017-3791: A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with…
PriorityP269critical10CVSS 3.0
AVNACLPRNUINSCCHIHAH
EPSS
4.11%
89.5th percentile
A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges. This vulnerability affects Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCvb49837.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_prime_home | — | — |
| cisco | cisco_prime_home | — | — |
| cisco | cisco_prime_home | — | — |
| cisco | cisco_prime_home | — | — |
| cisco | cisco_prime_home | — | — |
| cisco | cisco_prime_home | — | — |
| cisco | prime_home | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit involves sending API commands via HTTP to a particular URL without prior authentication, targeting the RBAC URL processing logic in Cisco Prime Home's web-based GUI ↗
- →Monitor for unauthenticated HTTP requests to Cisco Prime Home API endpoints — absence of authentication headers/session tokens on API URLs is a key indicator of exploitation attempts ↗
- ·Affected versions are Cisco Prime Home 6.3.0.0 through 6.5.0.0 (inclusive); first fixed release is 6.5.0.1. Ensure patched version is deployed. ↗
- ·No workarounds exist for this vulnerability; software update to 6.5.0.1 or later is the only remediation. ↗
CVSS provenance
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Prime Home Authentication Bypass Vulnerability
vendor_cisco·2017-02-01·CVSS 10.0
CVE-2017-3791 [CRITICAL] CWE-287 Cisco Prime Home Authentication Bypass Vulnerability
Cisco Prime Home Authentication Bypass Vulnerability
A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges.
The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/con
Cisco
Cisco Prime Home Authentication Bypass Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-3791 Cisco Prime Home Authentication Bypass Vulnerability
CVE-2017-3791: Cisco Prime Home Authentication Bypass Vulnerability
A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-287, CWE-287
Bug IDs: CSCvb49837
GHSA
GHSA-f8ff-pgcp-3fr6: A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions
ghsa_unreviewed·2022-05-13
CVE-2017-3791 [CRITICAL] CWE-287 GHSA-f8ff-pgcp-3fr6: A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions
A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges. This vulnerability affects Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCvb49837.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-02-01
Published