A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0, 5500…

Description

A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0, 5500 Series, and 5700 Series devices and Cisco Virtualized Packet Core (VPC) Software could allow an authenticated, local attacker to break from the StarOS CLI of an affected system and execute arbitrary shell commands as a Linux root user on the system, aka Command Injection. The vulnerability exists because the affected operating system does not sufficiently sanitize commands before inserting them into Linux shell commands. An attacker could exploit this vulnerability by submitting a crafted CLI command for execution in a Linux shell command as a root user. Cisco Bug IDs: CSCvc69329, CSCvc72930.

Scores

EPSS (exploitation in 30 days)

0.79% · top 44% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.

Weakness

• CWE-78 (opens in a new tab)All about CWE-78 and its CVEs

Affected products

• Cisco StarOS

  • affected Cisco StarOS

References (3)

• 1038818 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-asrcmd (opens in a new tab)x_refsource_CONFIRMx_transferred
• 99462 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-6707](https://trackcve.app/badge/CVE-2017-6707.svg)](https://trackcve.app/cve/CVE-2017-6707)

Record last updated 5 Aug 2024, 15:41 UTC.