CVE-2017-6617

A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not assign a new session identifier to a user session when a user authenticates to the web-based GUI. An attacker could exploit this vulnerability by using a hijacked session identifier to connect to the software through the web-based GUI. A successful exploit could allow the attacker to hijack an authenticated user's browser session on the affected system. Cisco Bug IDs: CSCvd14583.

• CWE-287
• CWE-287

• http://www.securityfocus.com/bid/97929Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc2Vendor Advisory
• http://www.securityfocus.com/bid/97929Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc2Vendor Advisory

Published

Apr 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6611A vulnerability in the web framework code of Cisco Prime Inf…
• CVE-2017-6612A vulnerability in the gateway GPRS support node (GGSN) of C…
• CVE-2017-6613A vulnerability in the DNS input packet processor for Cisco …
• CVE-2017-6614A vulnerability in the file-download feature of the web user…
• CVE-2017-6615A vulnerability in the Simple Network Management Protocol (S…
• CVE-2017-6616A vulnerability in the web-based GUI of Cisco Integrated Man…
• CVE-2017-6618A vulnerability in the web-based GUI of Cisco Integrated Man…
• CVE-2017-6619A vulnerability in the web-based GUI of Cisco Integrated Man…
• CVE-2017-6620A vulnerability in the remote management access control list…
• CVE-2017-6621A vulnerability in the web interface of Cisco Prime Collabor…
• CVE-2017-6622A vulnerability in the web interface for Cisco Prime Collabo…
• CVE-2017-6623A vulnerability in a script file that is installed as part o…