CVE-2017-6748

Published: Jul 25, 2017Modified: May 13, 2026

6.7

Vector

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88855. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270 10.1.1-234.

Affected (19)

Products: Cisco: Web Security Appliance, Web Security Virtual Appliance

Cisco

2 products

Web Security Appliance

Web Security Virtual Appliance

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Cisco Web Security Appliance	Version 10.0.0-232
Cisco Web Security Appliance	Version 10.0.0-233
Cisco Web Security Appliance	Version 10.0_base
Cisco Web Security Appliance	Version 10.1.0-204
Cisco Web Security Appliance	Version 10.1.0
Cisco Web Security Appliance	Version 10.1.1-230
Cisco Web Security Appliance	Version 10.5.0-358
Cisco Web Security Appliance	Version 10.5.0
Cisco Web Security Appliance	Version 11.0.0-613
Cisco Web Security Appliance	Version 11.0.0
Cisco Web Security Virtual Appliance	Version 10.0.0
Cisco Web Security Virtual Appliance	Version 10.0_base
Cisco Web Security Virtual Appliance	Version 10.1.0
Cisco Web Security Virtual Appliance	Version 10.1.1
Cisco Web Security Virtual Appliance	Version 10.1_base
Cisco Web Security Virtual Appliance	Version 10.5.1
Cisco Web Security Virtual Appliance	Version 10.5_base
Cisco Web Security Virtual Appliance	Version 11.0.0
Cisco Web Security Virtual Appliance	Version 11.0_base