CVE-2017-3801 Cisco CVE debrief

Who should care

Cisco UCS Director administrators, IAM/RBAC owners, and teams responsible for multi-tenant workflow governance on affected 6.0.0.0 and 6.0.0.1 deployments should prioritize this issue.

Technical summary

Cisco’s advisory and the NVD record describe improper RBAC enforcement after Developer Menu is enabled in Cisco UCS Director. The affected versions are 6.0.0.0 and 6.0.0.1. An authenticated local attacker with an end-user profile can enable Developer Mode for that profile, add new catalogs with arbitrary workflow items, and then execute the actions defined by those items. NVD lists the primary weakness as CWE-863 (Incorrect Authorization) and the CVSS vector as AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Defensive priority

High. The CVSS score is 8.8 and the flaw can turn a low-privilege authenticated account into a path for cross-tenant workflow abuse, so affected UCS Director instances should be reviewed promptly.

Recommended defensive actions

• Verify whether Cisco UCS Director 6.0.0.0 or 6.0.0.1 is deployed anywhere in the environment.
• Review Cisco’s vendor advisory for the product-specific mitigation guidance and any available fixes or workarounds.
• Check whether Developer Menu or Developer Mode can be enabled for non-administrative profiles and restrict it to trusted administrative roles only.
• Audit workflow/catalog permissions and remove or tightly control catalogs that expose powerful actions to end users.
• Review logs and tenant activity for unexpected catalog creation or workflow execution by low-privilege accounts.
• If the product is no longer required, decommission it or isolate it from general user access until a vendor-supported remediation is in place.

Evidence notes

All substantive claims here are drawn from the supplied Cisco/NVD corpus: the vulnerability affects Cisco UCS Director 6.0.0.0 and 6.0.0.1; it is an authenticated local privilege-escalation issue tied to improper RBAC after Developer Menu is enabled; and the primary weakness is CWE-863 per NVD. The CVSS vector and severity are taken from the NVD metadata. The CVE publication date used for timing context is 2017-02-15.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.