1. Home
  2. CVE Database
  3. CVE-2017-6079
CRITICAL · 9.8

CVE-2017-6079

The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use thi...

Vulnerability Description

The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side from the web application: if the command is valid, it executes. An example is the wget command. The page that allows this has been confirmed in firmware as old as 2006.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
RibboncommunicationsEdgemarc Firmware-
RibboncommunicationsEdgemarc 4550-
RibboncommunicationsEdgemarc 4552-
RibboncommunicationsEdgemarc 4601-
RibboncommunicationsEdgemarc 4700-
RibboncommunicationsEdgemarc 4750-
RibboncommunicationsEdgemarc 4800-
RibboncommunicationsEdgemarc 4806-
RibboncommunicationsEdgemarc 4808-
RibboncommunicationsEdgemarc 7301-
RibboncommunicationsEdgemarc 7400-

References

FAQ

What is CVE-2017-6079?

CVE-2017-6079 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use thi...

How severe is CVE-2017-6079?

CVE-2017-6079 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2017-6079?

Check the references section above for vendor advisories and patch information. Affected products include: Ribboncommunications Edgemarc Firmware, Ribboncommunications Edgemarc 4550, Ribboncommunications Edgemarc 4552, Ribboncommunications Edgemarc 4601, Ribboncommunications Edgemarc 4700.