9.8
CVE-2016-1291
- EPSS 6.77%
- Veröffentlicht 06.04.2016 23:59:11
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Erkennungen
LoginCisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Evolved Programmable Network Manager Version 1.2.0
Cisco ≫ Prime Infrastructure Version 1.2
Cisco ≫ Prime Infrastructure Version 1.2.0.103
Cisco ≫ Prime Infrastructure Version 1.2.1
Cisco ≫ Prime Infrastructure Version 1.3
Cisco ≫ Prime Infrastructure Version 1.3.0.20
Cisco ≫ Prime Infrastructure Version 1.4
Cisco ≫ Prime Infrastructure Version 1.4.0.45
Cisco ≫ Prime Infrastructure Version 1.4.1
Cisco ≫ Prime Infrastructure Version 1.4.2
Cisco ≫ Prime Infrastructure Version 2.0
Cisco ≫ Prime Infrastructure Version 2.1.0
Cisco ≫ Prime Infrastructure Version 2.2
Sun ≫ Opensolaris Version snv_124 Edition sparc
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 6.77% | 0.931 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 9.8 | 3.9 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| NIST | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-remcode
http://www.securitytracker.com/id/1035497
https://blogs.securiteam.com/index.php/archives/2727