V
Scaner-VS
ENRU
HomeCatalogSourcesCWECAPECATT&CKMitigationsDocs
←Back to catalog
BDU:2017-00655
BDU
CriticalConfirmedExploit available

Уязвимость в коде обработки протокола CMP сетевых устройств Cisco Systems Inc. связана с некорректной обработкой Telnet-опций, специфичных …

CVSS
10.0
Critical
EPSS
0.00
p0
Published
2017-01-01
Updated
2017-01-01
Description

Уязвимость в коде обработки протокола CMP сетевых устройств Cisco Systems Inc. связана с некорректной обработкой Telnet-опций, специфичных для протокола CMP, а также отсутствием ограничений на прием и обработку Telnet-сообщений из источников, не являющихся членами кластера. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код с повышенными привилегиями или вызвать отказ в обслуживании (перезагрузку устройства) путем отправки ему специально сформированных CMP-опций в рамках Telnet-соединения

Affected products
Cisco systems inc. Catalyst 2350-48td-s switchCisco systems inc. Catalyst 2350-48td-sd switchCisco systems inc. Catalyst 2360-48td-s switchCisco systems inc. Catalyst 2918-24tc-c switchCisco systems inc. Catalyst 2918-24tt-c switchCisco systems inc. Catalyst 2918-48tc-c switchCisco systems inc. Catalyst 2918-48tt-c switchCisco systems inc. Catalyst 2928-24tc-c switchCisco systems inc. Catalyst 2960-24-s switchCisco systems inc. Catalyst 2960-24lc-s switchCisco systems inc. Catalyst 2960-24lt-l switchCisco systems inc. Catalyst 2960-24pc-l switchCisco systems inc. Catalyst 2960-24pc-s switchCisco systems inc. Catalyst 2960-24tc-l switchCisco systems inc. Catalyst 2960-24tc-s switchCisco systems inc. Catalyst 2960-24tt-l switchCisco systems inc. Catalyst 2960-48pst-l switchCisco systems inc. Catalyst 2960-48pst-s switchCisco systems inc. Catalyst 2960-48tc-l switchCisco systems inc. Catalyst 2960-48tc-s switch
CVSS vector
AV:N/AC:L/Au:N/C:C/I:C/A:C
Timeline
2017-01-01
Published
2017-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Authentication
Au: N
None (N)
Confidentiality Impact
C: C
Complete
Integrity Impact
I: C
Complete
Availability Impact
A: C
Complete
Exploit indicators
EPSS
0.000 · p0
Known exploited (KEV)
No
Known exploits — Сканер-ВС
41872
exploitdb · https://www.exploit-db.com/exploits/41872
Enterprise
42122
exploitdb · https://www.exploit-db.com/exploits/42122
Enterprise
Affected software
ProductVendorStatus
catalyst 2350-48td-s switchcisco systems inc.Tracked
catalyst 2350-48td-sd switchcisco systems inc.Tracked
catalyst 2360-48td-s switchcisco systems inc.Tracked
catalyst 2918-24tc-c switchcisco systems inc.Tracked
catalyst 2918-24tt-c switchcisco systems inc.Tracked
catalyst 2918-48tc-c switchcisco systems inc.Tracked
catalyst 2918-48tt-c switchcisco systems inc.Tracked
catalyst 2928-24tc-c switchcisco systems inc.Tracked
catalyst 2960-24-s switchcisco systems inc.Tracked
catalyst 2960-24lc-s switchcisco systems inc.Tracked
catalyst 2960-24lt-l switchcisco systems inc.Tracked
catalyst 2960-24pc-l switchcisco systems inc.Tracked
catalyst 2960-24pc-s switchcisco systems inc.Tracked
catalyst 2960-24tc-l switchcisco systems inc.Tracked
catalyst 2960-24tc-s switchcisco systems inc.Tracked
catalyst 2960-24tt-l switchcisco systems inc.Tracked
catalyst 2960-48pst-l switchcisco systems inc.Tracked
catalyst 2960-48pst-s switchcisco systems inc.Tracked
catalyst 2960-48tc-l switchcisco systems inc.Tracked
catalyst 2960-48tc-s switchcisco systems inc.Tracked
Source databases
BDU
Related vulnerabilities
CVE-2017-3881