Critical severity · published Feb 3, 2017
CVE-2017-2768
EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Configuration Manager…
9.8
CVSS
3.6%
EPSS
No
On KEV
Description
EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Configuration Manager (NCM) 9.4.2.x contains an Improper Authentication vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
Smarts Network Configuration Manager · Emc
9.3; 9.4; 9.4.1; 9.4.2 · source: NVD
Affected product
SN
Smarts Network Configuration Manager
Emc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2768
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2768
Mailing List
http://www.securityfocus.com/archive/1/540085/30/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/95936
www.securitytracker.com
http://www.securitytracker.com/id/1037761
More from Smarts Network Configuration Manager
9.8
CVE-2017-2767
EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Configuration Manager…
6.1
CVE-2017-8017
EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x is affected by a reflected cross-site scripting Vulnerability that could potentially be exploited by…
–
CVE-2014-2509
Session fixation vulnerability in the Report Advisor (RA) component in EMC Network Configuration Manager (NCM) before 9.3 allows remote attackers to hijack web sessions via a…
–
CVE-2013-2717
Multiple unspecified vulnerabilities in the System Management (aka SysAdmin) Console in EMC Smarts Network Configuration Manager (NCM) through 9.2 have unknown impact and attack…
–
CVE-2013-0935
EMC Smarts Network Configuration Manager (NCM) before 9.2 does not require authentication for all Java RMI method calls, which allows remote attackers to execute arbitrary code…