ByteOS Network

NVD Vulnerability Details :

CVE-2017-6708

Deferred

Source-psirt@cisco.com

Published At-06 Jul, 2017 | 00:29

Updated At-20 Apr, 2025 | 01:37

A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulnerability is due to the absence of validation checks for the input that is used to create symbolic links. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76654.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.0

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

Cisco Systems, Inc.

>>ultra_services_framework>>Versions up to 5.0.2(inclusive)

cpe:2.3:a:cisco:ultra_services_framework:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-200	Secondary	psirt@cisco.com
CWE-200	Primary	nvd@nist.gov

CWE ID: CWE-200

Type: Secondary

Source: psirt@cisco.com

CWE ID: CWE-200

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/99512	psirt@cisco.com	N/A
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf1	psirt@cisco.com	Vendor Advisory
http://www.securityfocus.com/bid/99512	af854a3a-2127-422b-91ae-364da2661108	N/A
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf1	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory