PT-2016-4755 · Cisco · Cisco Prime Network Analysis Module+1

Published 2016-06-03 · Updated 2016-11-30 · CVE-2016-1388

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Network Analysis Module (NAM) versions prior to 6.1(1) patch.6.1-2-final Cisco Prime Network Analysis Module (NAM) versions 6.2.x prior to 6.2(1) Prime Virtual Network Analysis Module (vNAM) versions prior to 6.1(1) patch.6.1-2-final Prime Virtual Network Analysis Module (vNAM) versions 6.2.x prior to 6.2(1)

Description The issue allows remote attackers to execute arbitrary OS commands via a crafted HTTP request.

Recommendations For Cisco Prime Network Analysis Module (NAM) versions prior to 6.1(1) patch.6.1-2-final, update to 6.1(1) patch.6.1-2-final or later. For Cisco Prime Network Analysis Module (NAM) versions 6.2.x prior to 6.2(1), update to 6.2(1) or later. For Prime Virtual Network Analysis Module (vNAM) versions prior to 6.1(1) patch.6.1-2-final, update to 6.1(1) patch.6.1-2-final or later. For Prime Virtual Network Analysis Module (vNAM) versions 6.2.x prior to 6.2(1), update to 6.2(1) or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2016-1388

Affected Products

Cisco Prime Network Analysis Module

Prime Virtual Network Analysis Module

References · 4

• https://osv.dev/vulnerability/CVE-2016-1388 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1388 · Security Note
• http://securitytracker.com/id/1036013 · Note