PT-2016-6909 · Cisco · Cisco Firepower Management Center

Matt Bergin + 1 · Published 2016-10-06 · Updated 2024-11-26 · CVE-2016-6435

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Firepower Management Center version 6.0.1

Description The issue allows remote authenticated users to read arbitrary files via crafted parameters.

Recommendations For Cisco Firepower Management Center version 6.0.1, consider restricting access to the web console until a patch is available. Avoid using crafted parameters in the web console to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-6435

Affected Products

Cisco Firepower Management Center

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cisco_firepower_download.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40464 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-6435 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6435 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc2 · Vendor Advisory
• https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking · Note
• http://securityfocus.com/bid/93421 · Note
• https://korelogic.com/Resources/Advisories/KL-001-2016-006.txt · Note