Vulnerabilities > CVE-2017-6672 - Incorrect Authorization vulnerability in Cisco ASR 5000 Series Software

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

low complexity

cisco

CWE-863

NVD

Published: 2017-07-25

Updated: 2019-10-03

Summary

A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. More Information: CSCvb99022 CSCvc16964 CSCvc37351 CSCvc54843 CSCvc63444 CSCvc77815 CSCvc88658 CSCve08955 CSCve14141 CSCve33870.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco ASR 5000 Series Software 19.3.5 Cisco ASR 5000 Series Software 19.3.11 Cisco ASR 5000 Series Software 19.3.12 Cisco ASR 5000 Series Software 19.6.0 Cisco ASR 5000 Series Software 19.6.3 Cisco ASR 5000 Series Software 19.6.6 Cisco ASR 5000 Series Software 20.1.V5 Cisco ASR 5000 Series Software 20.2.4 Cisco ASR 5000 Series Software 20.2.12 Cisco ASR 5000 Series Software 20.3.0 Cisco ASR 5000 Series Software 20.3.1 Cisco ASR 5000 Series Software 21.0.V1.66638 Cisco ASR 5000 Series Software 21.0.V2 Cisco ASR 5000 Series Software 21.1.0 Cisco ASR 5000 Series Software 21.1.2 Cisco ASR 5000 Series Software 21.1.M0.65710 Cisco ASR 5000 Series Software 21.1.M0.65921 Cisco ASR 5000 Series Software 21.1.M0.65931 Cisco ASR 5000 Series Software 21.1.M0.65986 Cisco ASR 5000 Series Software 21.1.V0 Cisco ASR 5000 Series Software 21.2.A0.65914 Cisco ASR 5000 Series Software 21.2.A0.65995 Cisco ASR 5000 Series Software 21.3.0	23

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References