TI-2017-04446 Aliases CVE-2017-6690 GHSA-39wf-75mq-q4p3

Improper input validation in Cisco StarOS

LOW 25CWE-20Published 2017-06-13 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A vulnerability in the file check operation of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify arbitrary files on an affected system. More Information: CSCvd73726. Known Affected Releases: 21.0.v0.65839 21.3.M0.67005. Known Fixed Releases: 21.4.A0.67087 21.4.A0.67079 21.4.A0.67013 21.3.M0.67084 21.3.M0.67077 21.3.M0.66994 21.3.J0.66993 21.1.v0.67082 21.1.V0.67083.

Why it matters now

EPSS 0.0128 70th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Cisco StarOS	Cisco StarOS	—	No fix listed	CNA

Cisco StarOS Vendor— Affected Cisco StarOS Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:asr_5000_software:21.0.v0.65839:::::::*	21.0.v0.65839	Vulnerable	Cisco
cpe:2.3:a:cisco:asr_5000_software:21.3.m0.67005:::::::*	21.3.m0.67005	Vulnerable	Cisco
cpe:2.3:h:cisco:asr_5000:-:::::::*	not specified by NVD	Running on	Cisco

cpe:2.3:a:cisco:asr_5000_software:21.0.v0.65839:*:*:*:*:*:*:* Versions 21.0.v0.65839 Vulnerable ·Cisco
cpe:2.3:a:cisco:asr_5000_software:21.3.m0.67005:*:*:*:*:*:*:* Versions 21.3.m0.67005 Vulnerable ·Cisco
cpe:2.3:h:cisco:asr_5000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-6690
2026-10-03 Alias added: GHSA-39wf-75mq-q4p3

References

Advisory 1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-staros

TI-2017-04484 A vulnerability in the Border Gateway Protocol (BGP) processing functionality of the… CVSS 3.0HIGH 7.5
TI-2016-05537 Resource management flaw in Cisco StarOS 18.x through 21.x CVSS 3.0HIGH 7.5
TI-2016-01324 The General Packet Radio Switching Tunneling Protocol 1 (aka GTPv1) implementation on… CVSS 3.0HIGH 7.5
TI-2016-01340 Cisco ASR 5000 devices with software 18.3 through 20.0.0 allow remote attackers to make… CVSS 3.0MEDIUM 6.5
TI-2017-04527 Improper input validation in Cisco StarOS for ASR 5000 Series Aggregated Services Routers CVSS 3.0MEDIUM 6.7
TI-2015-05325 The Proxy Mobile IPv6 (PMIPv6) component in the CDMA implementation on Cisco ASR 5000… CVSS 2.0MEDIUM 5.0

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences