Lucene search

[email protected]CVE-2017-6631

HistorySep 07, 2017 - 9:29 p.m.

CVE-2017-6631

2017-09-0721:29:00

CWE-399

[email protected]

web.nvd.nist.gov

vulnerability

cisco

stb

receivers

remote

dos

yes

firmware

xml

http

rpc

cve-2017-6631

nvd

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.3%

JSON

A vulnerability in the HTTP remote procedure call (RPC) service of set-top box (STB) receivers manufactured by Cisco for Yes could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the firmware of an affected device fails to handle certain XML values that are passed to the HTTP RPC service listening on the local subnet of the device. An attacker could exploit this vulnerability by submitting a malformed request to an affected device. A successful attack could cause the affected device to restart, resulting in a DoS condition. Yes has updated the affected devices with firmware that addresses this vulnerability. Customers are not required to take action. Vulnerable Products: This vulnerability affects YesMaxTotal, YesMax HD, and YesQuattro STB devices. Cisco Bug IDs: CSCvd08812.

Affected configurations

NVD

Node

ciscoyesmax_hdMatch-

AND

ciscoyesmax_hd_firmwareMatch-

Node

ciscoyesmaxtotalMatch-

AND

ciscoyesmaxtotal_firmwareMatch-

Node

ciscoyesquattroMatch-

AND

ciscoyesquattro_firmwareMatch-

CPENameOperatorVersion
cisco:yesmax_hd_firmwarecisco yesmax hd firmwareeq-

CPE	Name	Operator	Version
cisco:yesmax_hd_firmware	cisco yesmax hd firmware	eq	-

CNA Affected

[
  {
    "product": "Cisco Yes Set-Top Box",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Yes Set-Top Box"
      }
    ]
  }
]

References

www.securityfocus.com/bid/100672

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-stb

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.3%

JSON

Related for CVE-2017-6631

prion1 cvelist1 nvd1 cisco1