CVE-2017-6649

Name: CVE-2017-6649
Creator: NVD / NIST
Published: 2017-05-22T01:29:00.76+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.85%

Last modified Jun 17, 2026

CVE-2017-6649 is a vulnerability of currently unknown severity. A vulnerability in the CLI of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. EPSS estimates a 0.85% chance of exploitation in the next 30 days.

Description

A vulnerability in the CLI of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command. An exploit could allow the attacker to read or write arbitrary files at the user's privilege level outside of the user's path. Cisco Bug IDs: CSCvb86787, CSCve60516, CSCve60555.

Metrics

EPSS Probability

0.85%

53.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Cisco	Nx-Os	7.1\(1\)n1\(1\)
Cisco	Nx-Os	7.1\(2\)n1\(1\)
Cisco	Nx-Os	7.1\(3\)n1\(1\)
Cisco	Nx-Os	7.1\(3\)n1\(2\)
Cisco	Nx-Os	7.1\(3\)n1\(2.1\)
Cisco	Nx-Os	7.1\(3\)n1\(3.12\)
Cisco	Nx-Os	7.1\(4\)n1\(1\)
Cisco	Nx-Os	7.2\(0\)d1\(0.437\)
Cisco	Nx-Os	7.2\(0\)n1\(1\)
Cisco	Nx-Os	7.2\(0\)zz\(99.1\)
Cisco	Nx-Os	7.2\(1\)n1\(1\)
Cisco	Nx-Os	7.3\(0\)n1\(1\)

References

http://www.securityfocus.com/bid/98531Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038518
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nssVendor Advisory
http://www.securityfocus.com/bid/98531Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038518
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nssVendor Advisory

Timeline

Published: May 22, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-6649?

How severe is CVE-2017-6649?

Severity scoring for CVE-2017-6649 is pending analysis. The EPSS model estimates a 0.85% probability of exploitation in the next 30 days.

How do I fix CVE-2017-6649?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-6649?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST