PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2768 Emc CVE debrief

CVE-2017-2768 is a critical improper authentication issue in EMC Network Configuration Manager (NCM). The affected versions listed in NVD are EMC NCM 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x. Because the vulnerability is rated 9.8 and the CVSS vector indicates network access, no privileges, and no user interaction, organizations should treat this as a high-priority exposure for any internet-facing or broadly reachable NCM deployment.

Vendor
Emc
Product
CVE-2017-2768
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-03
Original CVE updated
2026-05-13
Advisory published
2017-02-03
Advisory updated
2026-05-13

Who should care

Security teams, administrators, and operations staff responsible for EMC Network Configuration Manager (NCM) deployments running 9.3.x through 9.4.2.x should review this issue immediately. Asset owners should care most where NCM is reachable from untrusted networks or is used to manage critical infrastructure.

Technical summary

NVD classifies the flaw as an improper authentication weakness (CWE-287) in EMC Network Configuration Manager. The published CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates a remotely reachable issue requiring no privileges or user interaction and with severe confidentiality, integrity, and availability impact. The affected CPEs include EMC Smarts Network Configuration Manager 9.3, 9.4, 9.4.1, and 9.4.2.

Defensive priority

Immediate. A critical, network-reachable authentication flaw with no required privileges or user interaction should be prioritized for rapid exposure reduction and remediation planning.

Recommended defensive actions

  • Confirm whether any EMC Network Configuration Manager instances are running affected versions 9.3.x, 9.4.0.x, 9.4.1.x, or 9.4.2.x.
  • Review the linked NVD and EMC references for vendor remediation guidance and apply the vendor-provided fix or move to a non-affected release.
  • Restrict access to NCM administration interfaces to trusted management networks while remediation is in progress.
  • Increase monitoring for anomalous authentication activity or unexpected administrative access attempts against NCM.
  • If an affected system cannot be upgraded quickly, document the exposure, apply compensating controls, and track remediation to completion.

Evidence notes

This debrief is based on the supplied NVD record and CVE metadata. Key evidence includes the vulnerability description identifying an improper authentication issue in EMC Network Configuration Manager, the affected versions listed in the NVD CPE criteria, the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CWE-287. Timing context uses the supplied CVE published date of 2017-02-03 and modified date of 2026-05-13.

Official resources

CVE published by NVD on 2017-02-03 and later modified on 2026-05-13.