The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented…
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for authorized/authenticated personnel from the Cisco Umbrella team to access the appliance remotely and obtain full control without explicit customer approval. To address this vulnerability, the Umbrella Virtual Appliance version 2.1.0 now requires explicit customer approval before an SSH tunnel from the VA to the Cisco terminating server can be established.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Umbrella Virtual Appliance Version 2.0.3 and prior | Cisco Umbrella Virtual Appliance Version 2.0.3 and prior | — | No fix listed | CNA |
- Cisco Umbrella Virtual Appliance Version 2.0.3 and prior Vendor— Affected Cisco Umbrella Virtual Appliance Version 2.0.3 and prior Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6679
- 2026-10-03 Alias added: GHSA-x42g-fj2g-26mm
References
Advisory 4
- https://www.info-sec.ca/advisories/Cisco-Umbrella.html
- https://support.umbrella.com/hc/en-us/articles/115004752143-Virtual-Appliance-Vulnerability-due-to-always-on-SSH-Tunnel-RESOLVED-2017-09-15
- https://support.umbrella.com/hc/en-us/articles/115004154423
- 20230816 Cisco Umbrella Virtual Appliance Undocumented Support Tunnel Vulnerability
More Cisco Umbrella Virtual Appliance vulnerabilities
- TI-2022-05332 Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability CVSS 3.1HIGH 7.5
- TI-2017-09122 Hard-coded credentials in Cisco Umbrella Insights Virtual Appliance CVSS 3.0HIGH 8.2
- TI-2022-05481 Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the… CVSS 3.1MEDIUM 6.5
- TI-2026-16437 Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability CVSS 3.1MEDIUM 6.0
Sources
- CVE-2017-6679 · CVE Program
- CVE-2017-6679 · NVD
- FIRST EPSS
- GHSA-x42g-fj2g-26mm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences