PT-2016-4690 · Cisco · Cisco Application Control Engine (Ace) 4710

Publicado 2016-02-26 · Atualizado 2016-12-06 · CVE-2016-1297

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Application Control Engine (ACE) 4710 A5 versions prior to A5(3.1)

Description The issue allows remote authenticated users to bypass intended Role-Based Access Control (RBAC) restrictions. This is achieved by executing arbitrary Command-Line Interface (CLI) commands with admin privileges via an unspecified parameter in a POST request to the Device Manager GUI.

Recommendations For versions prior to A5(3.1), update to version A5(3.1) or later to resolve the issue. As a temporary workaround, consider restricting access to the Device Manager GUI to minimize the risk of exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2016-1297

Produtos afetados

Cisco Application Control Engine (Ace) 4710

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-1297 · Aviso do Fabricante
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-ace · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1297 · Nota de Segurança
• http://securitytracker.com/id/1035104 · Nota