CVE-2017-6683: A vulnerability in the esc_listener.py script of Cisco Elastic Services Controllers could allow an authenti...

Security readout for executives and security teams

Cisco Elastic Services Controller had a flaw in esc_listener.py that could let a logged-in remote attacker run arbitrary commands as the tomcat user. This is not described as unauthenticated compromise, but successful abuse could affect service controller integrity and operations. Exposure is most likely where Cisco Elastic Services Controller is deployed and reachable by users or systems with valid credentials. The provided source names Cisco Elastic Services Controller and known affected release 2.2(9.76), but does not define all affected versions. Treat as high priority if Cisco ESC is present, especially on management networks. It is authenticated, but command execution on an infrastructure controller can create operational and security impact. Prioritize inventory, vendor guidance, and access restriction. Mitigation focus: Review Cisco advisory cisco-sa-20170607-esc2 for fixed software and official guidance.; Inventory Cisco Elastic Services Controller deployments and identify version 2.2(9.76).; Restrict ESC management access to trusted administrators and networks while validating exposure..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.