PT-2016-4758 · Cisco · Cisco Prime Network Analysis Module+1

Publicado 2016-06-04 · Atualizado 2021-09-09 · CVE-2016-1391

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Network Analysis Module (NAM) versions prior to 6.1(1) patch.6.1-2-final Cisco Prime Network Analysis Module (NAM) versions 6.2.x prior to 6.2(2) Prime Virtual Network Analysis Module (vNAM) versions prior to 6.1(1) patch.6.1-2-final Prime Virtual Network Analysis Module (vNAM) versions 6.2.x prior to 6.2(2)

Description The issue allows remote authenticated users to execute arbitrary OS commands via a crafted HTTP request.

Recommendations For Cisco Prime Network Analysis Module (NAM) versions prior to 6.1(1) patch.6.1-2-final, update to version 6.1(1) patch.6.1-2-final or later. For Cisco Prime Network Analysis Module (NAM) versions 6.2.x prior to 6.2(2), update to version 6.2(2) or later. For Prime Virtual Network Analysis Module (vNAM) versions prior to 6.1(1) patch.6.1-2-final, update to version 6.1(1) patch.6.1-2-final or later. For Prime Virtual Network Analysis Module (vNAM) versions 6.2.x prior to 6.2(2), update to version 6.2(2) or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-1391

Produtos afetados

Cisco Prime Network Analysis Module

Prime Virtual Network Analysis Module

Referências · 4

• http://securitytracker.com/id/1036014 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1391 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1391 · Aviso do Fabricante