PT-2016-1744 · Cisco · Cisco Unified Computing System (Ucs) Central

Published 2016-04-14 · Updated 2016-12-03 · CVE-2016-1352

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System (UCS) Central Software versions 1.3(1b) and earlier

Description The issue allows remote attackers to execute arbitrary OS commands via a crafted HTTP request. This is due to the system's failure to neutralize special elements used in the OS command. Exploitation of the issue may allow a remote attacker to execute arbitrary OS commands using a specially crafted HTTP request.

Recommendations For Cisco Unified Computing System (UCS) Central Software versions 1.3(1b) and earlier, update to a version later than 1.3(1b) to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2016-01070

CVE-2016-1352

Affected Products

Cisco Unified Computing System (Ucs) Central

References · 5

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160413-ucs · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01070 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1352 · Security Note
• http://securitytracker.com/id/1035565 · Note