OS command injection in Cisco Ultra Services Framework
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The vulnerability is due to improper shell invocations. An attacker could exploit this vulnerability by crafting CLI command inputs to execute Linux shell commands as the root user. This vulnerability affects all releases of Cisco Ultra Services Framework Staging Server prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76673.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Ultra Services Framework | Cisco Ultra Services Framework | — | No fix listed | CNA |
- Cisco Ultra Services Framework Vendor— Affected Cisco Ultra Services Framework Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6714
- 2026-10-03 Alias added: GHSA-pch2-25gv-rxqj
References
More Cisco Ultra Services Framework Staging Server vulnerabilities
- TI-2017-04441 A vulnerability in Cisco Ultra Services Framework Staging Server could allow an… CVSS 3.0HIGH 8.8
Sources
- CVE-2017-6714 · CVE Program
- CVE-2017-6714 · NVD
- FIRST EPSS
- GHSA-pch2-25gv-rxqj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences