CVE-2017-6709

The CVE-2017-6709 case concerns Cisco’s Ultra Services Framework AutoVNF, where the AutoVNF tool logs administrative credentials in plaintext. This creates a risk that an unauthenticated, remote attacker could read credentials from the log files stored at the AutoVNF URL, enabling access to Cisco...

CVE-2017-6711

Summary (CVE-2017-6711): Cisco Ultra Services Framework’s Ultra Automation Service (UAS) is vulnerable due to an insecure default ZooKeeper configuration. An unauthenticated, remote attacker could access the device via the orchestrator network, gain access to ZooKeeper znodes, and influence the s...

CVE-2017-6681

The CVE-2017-6681 vulnerability affects Cisco Ultra Services Framework (USF) AutoVNF VNFStagingView, specifically a flaw in URL handling that allows a remote, unauthenticated attacker to perform a relative path traversal and read sensitive files. Affected release is Cisco USF version 21.0.0. The ...

CVE-2017-6708

CVE-2017-6708 affects Cisco Ultra Services Framework via the AutoVNF symlink creation function. Root cause: lack of input validation when creating symbolic links, enabling an unauthenticated, remote attacker to read sensitive files or execute code. Affected releases are all prior to 5.0.3 and 5.1...

CVE-2017-6771

The CVE-2017-6771 vulnerability affects the Cisco Ultra Services Framework AutoVNF automation tool, where an unauthenticated, remote attacker can view sensitive configuration data by browsing to a specific URL. Root cause: inadequate protection of sensitive data within AutoVNF. Impact: informatio...

CVE-2017-6680

The CVE-2017-6680 issue affects Cisco Ultra Services Framework (USF) AutoVNF logging function. The vulnerability arises from insufficient checks when creating directories, allowing an unauthenticated, remote attacker to create arbitrary directories on the affected system (potentially as root) and...