PT-2016-1646 · Cisco · Cisco Evolved Programmable Network Manager+1

Published 2016-04-06 · Updated 2019-07-29 · CVE-2016-1291

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Evolved Programmable Network Manager versions 1.2 Cisco Prime Infrastructure versions 1.2.0 through 2.2(2)

Description The issue exists due to insufficient input validation, allowing a remote attacker to execute arbitrary code by sending a specially crafted HTTP POST request with deserialized data.

Recommendations For Cisco Evolved Programmable Network Manager version 1.2, update to a version that addresses the issue. For Cisco Prime Infrastructure versions 1.2.0 through 2.2(2), update to a version that addresses the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00958

CVE-2016-1291

Affected Products

Cisco Evolved Programmable Network Manager

Cisco Prime Infrastructure

References · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-remcode · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1291 · Security Note
• https://bdu.fstec.ru/vul/2016-00958 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1291 · Vendor Advisory
• http://securitytracker.com/id/1035497 · Note
• https://blogs.securiteam.com/index.php/archives/2727 · Note