PT-2016-4732 · Cisco · Cisco Prime Lan Management Solution

Published 2016-03-12 · Updated 2016-12-03 · CVE-2016-1360

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime LAN Management Solution (LMS) versions through 4.2.5

Description The issue allows local users to obtain cleartext data by leveraging console connectivity, due to the use of the same database decryption key across different customers' installations.

Recommendations For versions through 4.2.5, update to a version that uses unique database decryption keys for each customer's installation to prevent unauthorized access to cleartext data.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-1360

Affected Products

Cisco Prime Lan Management Solution

References · 4

• https://osv.dev/vulnerability/CVE-2016-1360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1360 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160310-prime-lms · Vendor Advisory
• http://securitytracker.com/id/1035313 · Note