SB2017061201 - Two vulnerabilities in Cisco Prime Data Center Network Manager
Published: June 12, 2017
Security Bulletin ID
SB2017061201
Severity
High
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Security bypass (CVE-ID: CVE-2017-6640)
The vulnerability allows a remote unauthenticated attacker to bypass security restrictions on the target system.The weakness exists in Cisco Prime Data Center Network Manager (DCNM) Software due to use of default, static password by user account. A remote attacker can connect to an affected system and use the credentials for default user account to log in to the affected software and gain access to the administrative console of a DCNM server.
Successful exploitation of the vulnerability results in full access to the device.
2) Security bypass (CVE-ID: CVE-2017-6639)
The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information or execute arbitrary code on the target system.The weakness exists in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) due to the lack of authentication and authorization mechanisms for a debugging tool. A remote attacker can connect to the debugging tool via TCP and access sensitive information about the affected software or execute arbitrary code with root privileges.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.