PT-2016-2114 · Cisco · Cisco Evolved Programmable Network Manager+1

Published 2016-05-25 · Updated 2019-07-29 · CVE-2016-1406

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure versions prior to 3.1 Cisco Evolved Programmable Network Manager versions prior to 1.2.4

Description The issue is related to a lack of proper access control in the API web interface, allowing remote authenticated users to bypass intended Role-Based Access Control (RBAC) restrictions. This can be achieved by sending crafted JSON data, potentially leading to the disclosure of sensitive information and privilege escalation.

Recommendations For Cisco Prime Infrastructure versions prior to 3.1, update to version 3.1 or later. For Cisco Evolved Programmable Network Manager versions prior to 1.2.4, update to version 1.2.4 or later. As a temporary workaround, consider restricting access to the API web interface until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2016-01467

CVE-2016-1406

Affected Products

Cisco Evolved Programmable Network Manager

Cisco Prime Infrastructure

References · 5

• https://bdu.fstec.ru/vul/2016-01467 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-1406 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1406 · Vendor Advisory
• http://securitytracker.com/id/1035948 · Note