Information disclosure in Cisco Wide Area Application Services
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system, aka Information Disclosure. This vulnerability affects the following products if they are running an affected release of Cisco Wide Area Application Services (WAAS) Software and are configured to use the Central Manager function: Cisco Virtual Wide Area Application Services (vWAAS), Cisco Wide Area Application Services (WAAS) Appliances, Cisco Wide Area Application Services (WAAS) Modules. Only Cisco WAAS products that are configured with the Central Manager role are affected by this vulnerability. More Information: CSCvd87574. Known Affected Releases: 4.4(7) 6.2(1) 6.2(3). Known Fixed Releases: 6.3(0.228) 6.3(0.226) 6.2(3d)8 5.5(7b)17.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Wide Area Application Services | Cisco Wide Area Application Services | — | No fix listed | CNA |
- Cisco Wide Area Application Services Vendor— Affected Cisco Wide Area Application Services Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:wide_area_application_services:4.4\(7\):*:*:*:*:*:*:* | 4.4(7) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:wide_area_application_services:6.2\(1\):*:*:*:*:*:*:* | 6.2(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:wide_area_application_services:6.2\(3\):*:*:*:*:*:*:* | 6.2(3) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:wide_area_application_services:4.4\(7\):*:*:*:*:*:*:* Versions 4.4(7) Vulnerable ·Cisco
- cpe:2.3:a:cisco:wide_area_application_services:6.2\(1\):*:*:*:*:*:*:* Versions 6.2(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:wide_area_application_services:6.2\(3\):*:*:*:*:*:*:* Versions 6.2(3) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6730
- 2026-10-03 Alias added: GHSA-rm85-79m7-hgch
References
More Cisco Wide Area Application Services vulnerabilities
- TI-2013-03008 The web service framework in Cisco WAAS Software 4.x and 5.x before 5.0.3e, 5.1.x before… CVSS 2.0HIGH 10.0
- TI-2013-03009 The web framework in Cisco WAAS Software before 4.x and 5.x before 5.0.3e, 5.1.x before… CVSS 2.0HIGH 9.0
- TI-2014-01739 Cisco Wide Area Application Services (WAAS) 5.1.1 before 5.1.1e, when SharePoint prefetch… CVSS 2.0HIGH 9.3
- TI-2007-03800 The Common Internet File System (CIFS) optimization in Cisco Wide Area Application… CVSS 2.0HIGH 7.8
- TI-2015-05404 cifs-ao in the CIFS optimization functionality on Cisco Wide Area Application Service… CVSS 3.0HIGH 7.5
- TI-2018-00288 Hard-coded credentials in Cisco Wide Area Application Services unknown CVSS 3.1MEDIUM 5.3
Sources
- CVE-2017-6730 · CVE Program
- CVE-2017-6730 · NVD
- FIRST EPSS
- GHSA-rm85-79m7-hgch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences