PT-2016-4690 · Cisco · Cisco Application Control Engine (Ace) 4710

Published 2016-02-26 · Updated 2016-12-06 · CVE-2016-1297

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Application Control Engine (ACE) 4710 A5 versions prior to A5(3.1)

Description The issue allows remote authenticated users to bypass intended Role-Based Access Control (RBAC) restrictions. This is achieved by executing arbitrary Command-Line Interface (CLI) commands with admin privileges via an unspecified parameter in a POST request to the Device Manager GUI.

Recommendations For versions prior to A5(3.1), update to version A5(3.1) or later to resolve the issue. As a temporary workaround, consider restricting access to the Device Manager GUI to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2016-1297

Affected Products

Cisco Application Control Engine (Ace) 4710

References · 4

• https://osv.dev/vulnerability/CVE-2016-1297 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-ace · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1297 · Security Note
• http://securitytracker.com/id/1035104 · Note