$ cve CVE-2017-6640 JSON

CVE-2017-6640

9.8

CRITICAL · CVSS 3.0 · EPSS 10.7% (pctl 96)

Patch early

EPSS 10.7% — above the 10% action threshold.

Description

A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administrative console of a DCNM server by using an account that has a default, static password. The account could be granted root- or system-level privileges. The vulnerability exists because the affected software has a default user account that has a default, static password. The user account is created automatically when the software is installed. An attacker could exploit this vulnerability by connecting remotely to an affected system and logging in to the affected software by using the credentials for this default user account. A successful exploit could allow the attacker to use this default user account to log in to the affected software and gain access to the administrative console of a DCNM server. This vulnerability affects Cisco Prime Data Center Network Manager (DCNM) Software releases prior to Release 10.2(1) for Microsoft Windows, Linux, and Virtual Appliance platforms. Cisco Bug IDs: CSCvd95346.

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	10.72% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-264
On CISA KEV	no
Public exploit	none known
Published	2017-06-08
Last modified	2026-06-17

Affected (1)

Vendor	Product
cisco	prime data center network manager

References

→ the Explorer · watch your stack · NVD