CVE-2017-6750
HighSummary
A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated local attacker to log in to the device with the privileges of a limited user or an unauthenticated remote attacker to authenticate to certain areas of the web GUI.
Risk Assessment
This vulnerability poses a risk of unauthorized access to the device, which could lead to further attacks on the organization's network infrastructure.
Recommendation
It is recommended to upgrade to version 10.5.1-270 or later to mitigate this vulnerability.
Other vulnerabilities in Cisco Web Security Appliance (WSA)
See all- CVE-2016-1296High
The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to bypass intended proxy restrictions via a malformed HTTP method.
- CVE-2015-0693High
Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, allowing local users to execute arbitrary Python code and gain privileges via a crafted pickle file.
Original NVD description (English source)
A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to log in to the device with the privileges of a limited user or an unauthenticated, remote attacker to authenticate to certain areas of the web GUI, aka a Static Credentials Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCve06124. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270.