PT-2016-2782 · Cisco · Cisco Ios+1

Published 2016-09-14 · Updated 2017-07-30 · CVE-2016-6404

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.5(2)T and earlier

Description A cross-site scripting (XSS) issue exists in the web framework of Cisco IOx Local Manager, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. The vulnerability is due to insufficient input validation of some parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting the malicious code, potentially allowing the attacker to execute arbitrary code in the context of the affected site or access sensitive browser-based information.

Recommendations For Cisco IOS version 15.5(2)T, update to a fixed version to resolve the issue. At the moment, there is no information about additional mitigation measures for other affected versions.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-02185

CVE-2016-6404

Affected Products

Cisco Ios

Cisco Iox Local Manager

References · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-ios · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-02185 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6404 · Security Note
• http://securityfocus.com/bid/92963 · Note
• http://securitytracker.com/id/1036834 · Note