PT-2016-2322 · Cisco · Cisco Evolved Programmable Network Manager+1

Publicado 2016-07-02 · Atualizado 2019-07-29 · CVE-2016-1408

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure versions 1.2 through 3.1 Evolved Programmable Network Manager (EPNM) versions 1.2 and 2.0

Description The issue exists due to insufficient input validation in the software, allowing a remote attacker to upload files or execute arbitrary commands using a specially crafted HTTP request.

Recommendations For Cisco Prime Infrastructure versions 1.2 through 3.1, update the software to a version that includes the necessary security patches. For Evolved Programmable Network Manager (EPNM) versions 1.2 and 2.0, update the software to a version that includes the necessary security patches. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-01711

CVE-2016-1408

Produtos afetados

Cisco Prime Infrastructure

Cisco Evolved Programmable Network Manager

Referências · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160629-pi-epnm · Aviso do Fabricante
• http://securityfocus.com/bid/91506 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-1408 · Nota de Segurança
• http://securitytracker.com/id/1036197 · Nota
• https://osv.dev/vulnerability/CVE-2016-1408 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01711 · Nota de Segurança