cbcvebase.
CVE-2017-6683
published 2017-06-13

CVE-2017-6683: A vulnerability in the esc_listener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute arbitrary commands…

PriorityP260high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
5.86%
92.3th percentile
A vulnerability in the esc_listener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system, aka an Authentication Request Processing Arbitrary Command Execution Vulnerability. More Information: CSCvc76642. Known Affected Releases: 2.2(9.76).

Affected

2 ranges
VendorProductVersion rangeFixed in
ciscoelastic_services_controller——
ciscoelastic_services_controller——

Detection & IOCsextracted from sources · hover to see the quote

portTCP/6000↗
filenameesc_listener.py↗
  • →Monitor for crafted authentication requests sent to TCP port 6000 on Cisco Elastic Services Controller systems, which targets the monitoring daemon via esc_listener.py. ↗
  • →Alert on unexpected process execution or OS commands spawned under the 'tomcat' user context on Cisco ESC systems, as successful exploitation results in arbitrary command execution as the tomcat user. ↗
  • →Inspect authentication arguments passed to the ESC monitoring daemon for unsanitized/shell-injectable content, as the root cause is insufficient sanitization of authentication arguments. ↗
  • ·Only Cisco Elastic Services Controller version 2.2(9.76) is confirmed affected; ensure patched versions are deployed. ↗
  • ·There are no workarounds available for this vulnerability; patching is the only remediation path. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco5.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.