CVE-2017-6620: Input Validation
A vulnerability in the remote management access control list (ACL) feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress connection request to the remote management interface. An attacker could exploit this vulnerability by sending a connection to the management IP address or domain name of the targeted device. A successful exploit could allow the attacker to bypass the configured remote management ACL. This can occur when the Remote Management configuration parameter is set to Disabled. This vulnerability affects Cisco CVR100W Wireless-N VPN Routers running a firmware image prior to 1.0.1.24. Cisco Bug IDs: CSCvc14457.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6620?
CVE-2017-6620 has been assigned a high severity rating due to its potential to allow unauthorized remote access.
How do I fix CVE-2017-6620?
To fix CVE-2017-6620, update the Cisco CVR100W Router firmware to the latest version available.
Who is affected by CVE-2017-6620?
CVE-2017-6620 affects users of the Cisco CVR100W Wireless-N VPN Router firmware version 1.0.1.19.
Can CVE-2017-6620 lead to further exploitation?
Yes, an attacker exploiting CVE-2017-6620 could gain unauthorized access and initiate further attacks on the network.
What does CVE-2017-6620 exploit in Cisco devices?
CVE-2017-6620 exploits a flaw in the remote management access control list implemented in the Cisco CVR100W Router.