{"schemaVersion":3,"id":"CVE-2017-6620","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability in the remote management access control list (ACL) feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress connection request to the remote management interface. An attacker could exploit this vulnerability by sending a connection to the management IP address or domain name of the targeted device. A successful exploit could allow the attacker to bypass the configured remote management ACL. This can occur when the Remote Management configuration parameter is set to Disabled. This vulnerability affects Cisco CVR100W Wireless-N VPN Routers running a firmware image prior to 1.0.1.24. Cisco Bug IDs: CSCvc14457.","dates":{"published":"2017-05-03T21:00:00.000Z","modified":"2024-08-05T15:33:20.471Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.8,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":5.8,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01633,"percentile":0.75921,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01633},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01786,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01633,"percentile":0.75921}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01786,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01633,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01633,"percentile":0.75921}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-264","name":"Permissions, Privileges, and Access Controls","description":"Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.","type":"category","status":"Obsolete","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/264.html"},{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"cisco","product":"small_business_rv_series_router_firmware","name":"small business rv series router firmware","label":"small_business_rv_series_router_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"1.0.1.19","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0.1.19","eol":null,"hubHref":"/vendor/cisco/small_business_rv_series_router"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id/1038395","label":"www.securitytracker.com/id/1038395","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cvr100w2","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cvr100w2","hostname":"tools.cisco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/98289","label":"www.securityfocus.com/bid/98289","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-05-03T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T15:33:20.471Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":24,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T16:32:28.745Z","stale":false,"partial":false}}