PT-2016-6900 · Cisco · Cisco Unified Intelligence Center+1

Published 2016-10-05 · Updated 2017-07-30 · CVE-2016-6426

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center (CUIC) versions 8.5.4 through 9.1(1) Unified Contact Center Express versions 10.0(1) through 11.0(1)

Description The issue allows remote attackers to create user accounts by visiting an unspecified web page. This is related to the j spring security switch user function.

Recommendations For Cisco Unified Intelligence Center (CUIC) versions 8.5.4 through 9.1(1), consider restricting access to the j spring security switch user function until a fix is available. For Unified Contact Center Express versions 10.0(1) through 11.0(1), restrict access to the vulnerable web page associated with the j spring security switch user function to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-6426

Affected Products

Cisco Unified Intelligence Center

Cisco Unified Contact Center Express

References · 5

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ucis2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6426 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6426 · Vendor Advisory
• http://securityfocus.com/bid/93420 · Note
• http://securitytracker.com/id/1036952 · Note