CVE-2017-6672

Description

A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. More Information: CSCvb99022 CSCvc16964 CSCvc37351 CSCvc54843 CSCvc63444 CSCvc77815 CSCvc88658 CSCve08955 CSCve14141 CSCve33870.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.372

Associated Vulnerability

VulnerabilityOS Platform
Cisco ASR 5000 Series Aggregation Services Routers Access Control List Security Bypass Vulnerability For Cisco MME Mobility Management EntityNCM
Cisco ASR 5000 Series Aggregation Services Routers Access Control List Security Bypass Vulnerability For Cisco PGW Packet Data Network GatewayNCM
Cisco ASR 5000 Series Aggregation Services Routers Access Control List Security Bypass Vulnerability For Cisco GGSN Gateway GPRS Support NodeNCM
Cisco ASR 5000 Series Aggregation Services Routers Access Control List Security Bypass Vulnerability For Cisco SGW Serving GatewayNCM
Cisco ASR 5000 Series Aggregation Services Routers Access Control List Security Bypass Vulnerability For Cisco ASR 5000 SeriesNCM
Incorrect Authorization Vulnerability (CVE-2017-6672)NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-1705701Security Update for Cisco MME Mobility Management Entity 20.0.vg0.63522
PATCH-1705563Security Update for Cisco PGW Packet Data Network Gateway 17.0.E0.55671
PATCH-1705677Security Update for Cisco GGSN Gateway GPRS Support Node 20.0.M0.60163
PATCH-1705154Security Update for Cisco SGW Serving Gateway 21.5.26.76063
PATCH-1706032Security Update for Cisco ASR 5000 Series 21.3.A0.66703

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234