Cisco Ultra Services Framework vulnerabilities

6 CVEs affecting Cisco Ultra Services Framework, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-6771, published 2017-08-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-6681, published 2017-06-13. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability in the AutoVNF VNFStagingView class of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to execute a relative path traversal attack, enabling an attacker…
CVE-2017-6771, published 2017-08-17. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the AutoVNF automation tool of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to acquire sensitive information. The vulnerability is due to…
CVE-2017-6711, published 2017-07-06. Critical severity, CVSS 9.1. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device. The…
CVE-2017-6708, published 2017-07-06. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive…
CVE-2017-6680, published 2017-06-13. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability in the AutoVNF logging function of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to create arbitrary directories on the affected system. More…
CVE-2017-6709, published 2017-07-06. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller…