CVE-2017-6713

CRITICAL

A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacker who can extract the static credentials from an existing installation of Cisco ESC could generate an admin session token that allows access to all instances of the ESC web UI. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76627.

Published: Jul 6, 2017 Modified: Jun 17, 2026

CWE-264 CWE-770

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (6)

Vendor	Product	Version
cisco	elastic_services_controller	1.0.0
cisco	elastic_services_controller	1.1.0
cisco	elastic_services_controller	2.0
cisco	elastic_services_controller	2.1.0
cisco	elastic_services_controller	2.2.0
cisco	elastic_services_controller	2.3.0

GitHub Security Advisory GHSA-96vr-63hc-8mgg

A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an...

References (4)

http://www.securityfocus.com/bid/99437 Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-esc2 Vendor Advisory
http://www.securityfocus.com/bid/99437 Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-esc2 Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 2.93%

Top 14% most likely to be exploited

Threat Score 40.1 / 100

Data Sources

NVD EPSS GitHub