Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-6748

A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88855. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270 10.1.1-234.

Published

2017-07-25T19:29:00.270

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 6.7 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-74
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco web_security_appliance 10.0.0-232 Yes
Application cisco web_security_appliance 10.0.0-233 Yes
Application cisco web_security_appliance 10.0_base Yes
Application cisco web_security_appliance 10.1.0 Yes
Application cisco web_security_appliance 10.1.0-204 Yes
Application cisco web_security_appliance 10.1.1-230 Yes
Application cisco web_security_appliance 10.5.0 Yes
Application cisco web_security_appliance 10.5.0-358 Yes
Application cisco web_security_appliance 11.0.0 Yes
Application cisco web_security_appliance 11.0.0-613 Yes
Application cisco web_security_virtual_appliance 10.0.0 Yes
Application cisco web_security_virtual_appliance 10.0_base Yes
Application cisco web_security_virtual_appliance 10.1.0 Yes
Application cisco web_security_virtual_appliance 10.1.1 Yes
Application cisco web_security_virtual_appliance 10.1_base Yes
Application cisco web_security_virtual_appliance 10.5.1 Yes
Application cisco web_security_virtual_appliance 10.5_base Yes
Application cisco web_security_virtual_appliance 11.0.0 Yes
Application cisco web_security_virtual_appliance 11.0_base Yes
References