CVE-2017-6639 in the critical feed json
A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unau…
published 2017-06-08 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-15693
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 35.4%
- EPSS 35.4% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system. The vulnerability is due to the lack of authentication and authorization mechanisms for a debugging tool that was inadvertently enabled in the affected software. An attacker could exploit this vulnerability by remotely connecting to the debugging tool via TCP. A successful exploit could allow the attacker to access sensitive information about the affected software or execute arbitrary code with root privileges on the affected system. This vulnerability affects Cisco Prime Data Center Network Manager (DCNM) Software Releases 10.1(1) and 10.1(2) for Microsoft Windows, Linux, and Virtual Appliance platforms. Cisco Bug IDs: CSCvd09961.
Exploit prediction
35.39% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a Cisco Prime Data Center Network Manager Debug Remote Code Execution Vulnerability
Classification
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm1
vendor-advisory
-
securitytracker.com
/id/1038626
vdb-entry
-
securityfocus.com
/bid/98935
vdb-entry, third-party-advisory
- h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesb3p03762en_us
Sources
- CVE List CVE-2017-6639
- NVD CVE-2017-6639
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.