Vulnerabilities > CVE-2014-3307 - Remote Arbitrary Command Execution vulnerability in Cisco Small Cell DHCP Message Processing

CVSS 6.8 - MEDIUM

Attack vector

ADJACENT_NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

high complexity

cisco

NVD

Published: 2014-07-02

Updated: 2015-12-03

Summary

The DHCP client implementation in Universal Small Cell firmware on Cisco Small Cell products allows remote attackers to execute arbitrary commands via crafted DHCP messages, aka Bug ID CSCup47513. Per: http://cwe.mitre.org/data/definitions/77.html "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco Universal Small Cell Series Firmware -	1

References

http://secunia.com/advisories/59024
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3307
http://www.securityfocus.com/bid/68307
http://www.securitytracker.com/id/1030509