CVE-2017-6650
published 2017-05-22CVE-2017-6650: A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated…
PriorityP344high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.91%
56.3th percentile
A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into the Telnet CLI command. An exploit could allow the attacker to read or write arbitrary files at the user's privilege level outside of the user's path. Cisco Bug IDs: CSCvb86771.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | nexus_series_switches_telnet | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
| cisco | nx-os | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_cisco4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Nexus Series Switches Telnet CLI Command Injection Vulnerability
vendor_cisco·2017-05-17·CVSS 4.4
CVE-2017-6650 [MEDIUM] CWE-20 Cisco Nexus Series Switches Telnet CLI Command Injection Vulnerability
Cisco Nexus Series Switches Telnet CLI Command Injection Vulnerability
A vulnerability in the Telnet CLI command of Cisco NX-OS System Software running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack.
The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into the Telnet CLI command. An exploit could allow the attacker to read or write arbitrary files at the user’s privilege level outside of the user’s path.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss1
Cisco
Cisco Nexus Series Switches Telnet CLI Command Injection Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-6650 Cisco Nexus Series Switches Telnet CLI Command Injection Vulnerability
CVE-2017-6650: Cisco Nexus Series Switches Telnet CLI Command Injection Vulnerability
A vulnerability in the Telnet CLI command of Cisco NX-OS System Software running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into the Telnet CLI command. An exploit could allow the attacker to read or write arbitrary files at the user’s privilege level outside of the user’s path. There are no
CVSS: 3.0
CWE: CWE-20, CWE-20
Bug IDs: CSCvb86771
GHSA
GHSA-qmjg-x3m2-w2rj: A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7
ghsa_unreviewed·2022-05-13
CVE-2017-6650 [HIGH] CWE-20 GHSA-qmjg-x3m2-w2rj: A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7
A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into the Telnet CLI command. An exploit could allow the attacker to read or write arbitrary files at the user's privilege level outside of the user's path. Cisco Bug IDs: CSCvb86771.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/98528http://www.securitytracker.com/id/1038518https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss1http://www.securityfocus.com/bid/98528http://www.securitytracker.com/id/1038518https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss1
2017-05-22
Published