CVE-2017-6710

{
  "id": "CVE-2017-6710",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 9.2,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco Systems, Inc.",
          "product": "Virtual Network Function (VNF) Element Manager",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.0.4 and 5.1.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-08-17T20:29:00.370",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/100362",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-em",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/100362",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-em",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Cisco Virtual Network Function (VNF) Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to specify arbitrary commands that will run as root on the server. An attacker could use this setting to elevate privileges and run commands in the context of the root user on the server. Cisco Bug IDs: CSCvc76670. Known Affected Releases: prior to 5.0.4 and 5.1.4."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en Cisco Virtual Network Function (VNF) Element Manager podría permitir que un atacante remoto autenticado elevase privilegios y ejecutase comandos en el contexto del usuario root en el servidor. Esta vulnerabilidad se debe a la configuración de comandos que permite a los usuarios de Cisco VNF Element Manager especificar comandos arbitrarios que se ejecutarán como root en el servidor. Un atacante podría emplear esta configuración para elevar privilegios y ejecutar comandos en el contexto del usuario root en el servidor. Cisco Bug IDs: CSCvc76670. Versiones afectadas conocidas: anteriores a la 5.0.4 y 5.1.4"
    }
  ],
  "lastModified": "2026-06-17T01:22:50.757",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:virtual_network_function_element_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF9B8506-3299-4441-A13A-D7BE4D840689",
              "versionEndIncluding": "5.1.3"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:virtual_network_function_element_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA0EA90E-C0E1-4ECE-83E0-4CC1BDE3C2A7",
              "versionEndIncluding": "5.0.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}