CVE-2017-6781 — Improper Authentication

Vendor	Product	Version range	Fixed in
cisco	policy_suite	—	—
cisco	policy_suite	—	—
cisco	policy_suite	—	—
cisco	policy_suite	—	—
cisco	policy_suite	—	—
cisco	policy_suite	—	—
cisco_systems_inc	policy_suite	—	—
cisco_systems_inc	policy_suite	—	—
cisco_systems_inc	policy_suite	—	—
cisco_systems_inc	policy_suite	—	—
cisco_systems_inc	policy_suite	—	—

Cisco

Cisco Policy Suite Privilege Escalation Vulnerability

vendor_cisco·2017-08-16·CVSS 5.3

CVE-2017-6781 [MEDIUM] CWE-264 Cisco Policy Suite Privilege Escalation Vulnerability Cisco Policy Suite Privilege Escalation Vulnerability A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker to gain elevated privileges on an affected system. The affected privilege level is not at the root level. The vulnerability is due to incorrect role-based access control (RBAC) for shell user accounts. An attacker could exploit this vulnerability by authenticating to an affected appliance and providing crafted user input via the CLI. A successful exploit could allow the attacker to acquire a higher privilege level than should have been granted. To exploit this vulnerability, the attacker must log in to the appliance with valid credentials. There are no workarounds that address

Cisco

Cisco Policy Suite Privilege Escalation Vulnerability

vendor_cisco·CVSS 3.0

CVE-2017-6781 Cisco Policy Suite Privilege Escalation Vulnerability CVE-2017-6781: Cisco Policy Suite Privilege Escalation Vulnerability A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker to gain elevated privileges on an affected system. The affected privilege level is not at the root level. The vulnerability is due to incorrect role-based access control (RBAC) for shell user accounts. An attacker could exploit this vulnerability by authenticating to an affected appliance and providing crafted user input via the CLI. A successful exploit could allow the attacker to acquire a higher privilege level than should have been granted. To exploit this vulnerability, the attacker must log in to the appliance with valid credentials. There are no CVSS: 3.0 CWE

GHSA

GHSA-c787-vq26-34f6: A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local

ghsa_unreviewed·2022-05-13

CVE-2017-6781 [MEDIUM] CWE-287 GHSA-c787-vq26-34f6: A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker to gain elevated privileges on an affected system. The affected privilege level is not at the root level. The vulnerability is due to incorrect role-based access control (RBAC) for shell user accounts. An attacker could exploit this vulnerability by authenticating to an affected appliance and providing crafted user input via the CLI. A successful exploit could allow the attacker to acquire a higher privilege level than should have been granted. To exploit this vulnerability, the attacker must log in to the appliance with valid credentials. Cisco Bug IDs: CSCve37724. Known Affected Releases: 9.0.0, 9.1.0, 10.0.0, 11.0.0, 12.0.0.

CVE-2017-6781: A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker…

Affected

CVSS provenance