← Vulnerability feed

Vulnerability record · CVE-2017-6639 · published 8 June 2017

CVE-2017-6639: Cisco prime data center network manager missing authorization vulnerability

Cisco · Prime Data Center Network Manager

A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system. The vulnerability is due to the lack of authentication and authorization mechanisms for a debugging tool that was inadvertently enabled in the affected software. An attacker could exploit this vulnerability by remotely connecting to the debugging tool via TCP. A successful exploit could allow the attacker to access sensitive information about the affected software or execute arbitrary code with root privileges on the affected system. This vulnerability affects Cisco Prime Data Center Network Manager (DCNM) Software Releases 10.1(1) and 10.1(2) for Microsoft Windows, Linux, and Virtual Appliance platforms. Cisco Bug IDs: CSCvd09961.

9.8 CVSS 3.0 Critical EPSS 35% · top 1.6% CWE-16 · CWE-16CWE-862 · Missing authorization
9.8CVSS 3.0 base score, v2 10.0
35%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system. The vulnerability is due to the lack of authentication and authorization mechanisms for a debugging tool that was inadvertently enabled in the affected software. An attacker could exploit this vulnerability by remotely connecting to the debugging tool via TCP. A successful exploit could allow the attacker to access sensitive information about the affected software or execute arbitrary code with root privileges on the affected system. This vulnerability affects Cisco Prime Data Center Network Manager (DCNM) Software Releases 10.1(1) and 10.1(2) for Microsoft Windows, Linux, and Virtual Appliance platforms. Cisco Bug IDs: CSCvd09961.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/98935 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038626
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesb3p03762en_us
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm1 Vendor Advisory
http://www.securityfocus.com/bid/98935 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038626
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesb3p03762en_us
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm1 Vendor Advisory

Track CVE-2017-6639 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2015-0666Cisco Prime DCNM fmserver servlet path traversal file readThe fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) is vulnerable to directory traversal, letting a remote attacker …KEVEPSS 40%analysed10.0CVE-2013-5486Cisco Prime DCNM path traversal in processImageSave.jsp enables file writeCisco Prime Data Center Network Manager (DCNM) before 6.2(1) contains a directory traversal flaw in processImageSave.jsp where the chartid parameter …EPSS 76%analysed10.0CVE-2012-5417Cisco prime data center network manager permissions and access controls vulnerabilityCisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDeployer functionality, which all…EPSS 3.1%9.8CVE-2018-0258Cisco Prime file upload servlet path traversal and arbitrary file executionThe Cisco Prime File Upload servlet in Cisco Prime Data Center Network Manager (10.0 and later) and Cisco Prime Infrastructure (all versions) allows …EPSS 48%analysed9.8CVE-2017-6640Cisco prime data center network manager permissions and access controls vulnerabilityA vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administr…EPSS 11%8.1CVE-2018-0464Cisco prime data center network manager path traversal vulnerabilityA vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks an…EPSS 5.4%7.8CVE-2013-5487Cisco prime data center network manager information exposure vulnerabilityDCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrary files via unspecified vecto…EPSS 2.1%7.8CVE-2013-5490Cisco prime data center network manager information exposure vulnerabilityCisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrary text files via an XML external entity declarat…EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2017-6639), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.