CVE-2017-6711

published 2017-07-06

CVE-2017-6711: A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain…

Priority P3 59 critical 9.1 CVSS 3.0

AV N AC L PR N UI N S U C H I H A N

A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device. The vulnerability is due to an insecure default configuration of the Apache ZooKeeper service used by the affected software. An attacker could exploit this vulnerability by accessing the affected device through the orchestrator network. An exploit could allow the attacker to gain access to ZooKeeper data nodes (znodes) and influence the behavior of the system's high-availability feature. This vulnerability affects all releases of Cisco Ultra Services Framework UAS prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvd29395.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
cisco	ultra_services_framework	<= 5.0.2	—
cisco	ultra_services_framework_uas_unauthenticated_access	—	—

CVSS provenance

nvd v3.0 9.1 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:P/I:P/A:N

vendor_cisco 9.1 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287