CVE-2017-6622: Cisco Prime Collaboration Provisioning auth bypass and root command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote root command execution with a CVSS of 9.8 and public exploit code makes this an urgent patch target.

What it is

Cisco Prime Collaboration Provisioning's web interface lacks security constraints on certain HTTP request methods, allowing an unauthenticated remote attacker to bypass authentication and reach files through the web interface. The same flaw permits command injection that executes with root privileges. It affects releases prior to 12.1 and is rated critical.

Impact

An attacker gains unauthenticated remote code execution as root on the provisioning server, giving full control of the host and any data or credentials it holds.

Attack surface

Reachable over the network through the web interface via a crafted HTTP request; the CVSS vector shows no privileges or user interaction required. No authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.6217 (99.1st percentile) and an Exploit-DB entry (42888) exists, indicating public exploit code is available.

What to do

• Upgrade Cisco Prime Collaboration Provisioning to release 12.1 or later, per the Cisco advisory.
• If patching cannot be done immediately, restrict network access to the web interface to trusted management networks only.
• Disable or block unnecessary HTTP methods at the reverse proxy or firewall in front of the application.
• Audit the host for signs of compromise and rotate credentials stored or used by the provisioning system.

Detection

• Review web server and application logs for unusual or unexpected HTTP methods and requests to file-access paths.
• Monitor for child processes spawned by the web service, especially shells or commands running as root.
• Alert on outbound connections or new listening services originating from the provisioning host.
• Search for known exploit request patterns tied to Exploit-DB 42888 in proxy or IDS logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.