CVE-2017-6606: OS Command Injection
A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known Affected Releases: 15.6(1.1)S 16.1.2 16.2.0 15.2(1)E. Known Fixed Releases: Denali-16.1.3 16.2(1.8) 16.1(2.61) 15.6(2)SP 15.6(2)S1 15.6(1)S2 15.5(3)S3a 15.5(3)S3 15.5(2)S4 15.5(1)S4 15.4(3)S6a 15.4(3)S6 15.3(3)S8a 15.3(3)S8 15.2(5)E 15.2(4)E3 15.2(3)E5 15.0(2)SQD3 15.0(1.9.2)SQD3 3.9(0)E.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in Denali-16.1.3 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 16.2(1.8) - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 16.1(2.61) - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.6(2)SP - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.6(2)S1 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.6(1)S2 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.5(3)S3a - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.5(3)S3 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.5(2)S4 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.5(1)S4 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.4(3)S6a - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.4(3)S6 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.3(3)S8a - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.3(3)S8 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.2(5)E - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.2(4)E3 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.2(3)E5 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.0(2)SQD3 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 15.0(1.9.2)SQD3 - Upgrade
Upgrade
Cisco IOS XE Softwareto a version that resolves this vulnerability.Fixed in 3.9(0)E - Compensating control
Because the vulnerability requires physical access to the targeted system, restrict and monitor physical access to Cisco IOS XE devices (e.g., protect console access and device hardware) to prevent an unauthenticated attacker from reaching the system.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6606?
CVE-2017-6606 has a critical severity rating, as it allows unauthorized users to execute arbitrary commands with root privileges.
How do I fix CVE-2017-6606?
To fix CVE-2017-6606, upgrade your Cisco IOS XE software to a version that is not affected by this vulnerability.
Who is affected by CVE-2017-6606?
CVE-2017-6606 affects devices running Cisco IOS XE versions 3.1.0s through 3.18.0s.
What are the potential impacts of CVE-2017-6606?
The potential impacts of CVE-2017-6606 include unauthorized access and control over the underlying operating system.
Is physical access required to exploit CVE-2017-6606?
Yes, physical access to the affected system is required to exploit CVE-2017-6606.