CVE-2017-6708
CriticalSummary
A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulnerability is due to the absence of validation checks for the input that is used to create symbolic links.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data and the potential execution of malicious code, which could lead to serious security breaches.
Recommendation
It is recommended to update the Cisco Ultra Services Framework to versions 5.0.3 or 5.1 to mitigate this vulnerability and to implement additional input validation mechanisms.
Original NVD description (English source)
A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulnerability is due to the absence of validation checks for the input that is used to create symbolic links. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76654.