Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2017-6679 Details

Description

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for authorized/authenticated personnel from the Cisco Umbrella team to access the appliance remotely and obtain full control without explicit customer approval. To address this vulnerability, the Umbrella Virtual Appliance version 2.1.0 now requires explicit customer approval before an SSH tunnel from the VA to the Cisco terminating server can be established.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.4 MEDIUMVector:CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-tunnel-gJw5thgE	CVE	Vendor Advisory
https://support.umbrella.com/hc/en-us/articles/115004154423	CVE	Third Party Advisory
https://support.umbrella.com/hc/en-us/articles/115004752143-Virtual-Appliance-Vulnerability-due-to-always-on-SSH-Tunnel-RESOLVED-2017-09-15	CVE	Third Party Advisory
https://www.info-sec.ca/advisories/Cisco-Umbrella.html	CVE	Third Party Advisory
http://www.securityfocus.com/bid/101567	CVE	Third Party AdvisoryVDB Entry
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-tunnel-gJw5thgE	[email protected]	Vendor Advisory
https://support.umbrella.com/hc/en-us/articles/115004154423	[email protected]	Third Party Advisory
https://support.umbrella.com/hc/en-us/articles/115004752143-Virtual-Appliance-Vulnerability-due-to-always-on-SSH-Tunnel-RESOLVED-2017-09-15	[email protected]	Third Party Advisory
https://www.info-sec.ca/advisories/Cisco-Umbrella.html	[email protected]	Third Party Advisory
http://www.securityfocus.com/bid/101567	[email protected]	Third Party AdvisoryVDB Entry

see all 10 references

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-noinfo	Insufficient Information to Classify Weakness	[email protected]

Affected Products

Product	Versions
cisco umbrella virtual appliance	< 2.1.0
CPE cpe:2.3:a:cisco:umbrella_virtual_appliance:::::::: Remediation No remediation found in references.

Change History

10 change records found show changes

Date	Action	Recorded By
Jun 22, 2026	Modified Analysis	[email protected]
Jun 17, 2026	CVE Modified	[email protected]
May 13, 2026	CVE Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 17, 2023	CVE Modified	[email protected]
Oct 3, 2019	CWE Remap	[email protected]
Dec 19, 2017	Initial Analysis	[email protected]
Dec 5, 2017	CVE Modified	[email protected]
Dec 3, 2017	CVE Modified	[email protected]