Read the docs
TI-2017-04514 Aliases CVE-2017-6759GHSA-jqg6-p87q-mgfq

Improper input validation in Cisco Prime Collaboration Provisioning Tool

Priority LOW 32CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A vulnerability in the UpgradeManager of the Cisco Prime Collaboration Provisioning Tool 12.1 could allow an authenticated, remote attacker to write arbitrary files as root on the system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by triggering the upgrade package installation functionality. Cisco Bug IDs: CSCvc90304.

Why it matters now

EPSS 0.01543 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Prime Collaboration Provisioning ToolCisco Prime Collaboration Provisioning Tool—No fix listedCNA
  • Cisco Prime Collaboration Provisioning Tool Vendor— Affected Cisco Prime Collaboration Provisioning Tool Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:prime_collaboration_provisioning:12.1:*:*:*:*:*:*:*12.1VulnerableCisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-6759
  2. 2026-10-03 Alias added: GHSA-jqg6-p87q-mgfq

References

Advisory 2

  • TI-2017-04381 Access control flaw in Cisco Prime Collaboration Provisioning CVSS 3.0CRITICAL 9.8
  • TI-2018-00279 SQL injection in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00280 Improper authentication in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00278 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00277 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2016-01305 Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP… CVSS 3.0CRITICAL 9.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences