Privilege escalation in Elastic Services Controller - CVE-2017-6688
Published: June 9, 2017 / Updated: June 9, 2017
Vulnerability identifier: #VU6993
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6688
CWE-ID: CWE-259
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.
The weakness exists in Cisco Elastic Services Controllers on Linux systems due to existence of a default, weak, hard-coded password for the "root" account of an affected system. A remote attacker can use default password to log in to the system as Linux "root" user and gain "root" privileges on the system.
Successful exploitation of the vulnerability results in "root" access to the system.
The weakness exists in Cisco Elastic Services Controllers on Linux systems due to existence of a default, weak, hard-coded password for the "root" account of an affected system. A remote attacker can use default password to log in to the system as Linux "root" user and gain "root" privileges on the system.
Successful exploitation of the vulnerability results in "root" access to the system.
Affected software
Elastic Services Controller
How to mitigate CVE-2017-6688
Install update from vendor's website.