CVE-2016-1406
published 2016-05-25CVE-2016-1406: The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to…
PriorityP348high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
1.62%
73.3th percentile
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | evolved_programmable_network_manager | — | — |
| cisco | evolved_programmable_network_manager | — | — |
| cisco | evolved_programmable_network_manager | — | — |
| cisco | evolved_programmable_network_manager | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure_and_cisco_evolved_programmable_network_manager_json | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager JSON Privilege Escalation Vulnerability
vendor_cisco·2016-05-23·CVSS 6.5
CVE-2016-1406 [MEDIUM] CWE-264 Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager JSON Privilege Escalation Vulnerability
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager JSON Privilege Escalation Vulnerability
A vulnerability in the application programming interface (API) web interface of the Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, remote attacker to perform privilege escalation on the affected device. The attacker can escalate privileges to the root level in most cases.
The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests a web page or service that should be restricted. An attacker could exploit this vulnerability by performing reconnaissance attacks to the application web pages and services to identify potential devices of interest. The attacker could t
Cisco
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager JSON Privilege Escalation Vulnerability
vendor_cisco
CVE-2016-1406 Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager JSON Privilege Escalation Vulnerability
CVE-2016-1406: Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager JSON Privilege Escalation Vulnerability
A vulnerability in the application programming interface (API) web interface of the Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, remote attacker to perform privilege escalation on the affected device. The attacker can escalate privileges to the root level in most cases. The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests a web page or service that should be restricted. An attacker could exploit this vulnerability by performing reconnaissance attacks to the application web pages and services to identify potential devices of interest. The att
GHSA
GHSA-h7gf-vcf5-w2p6: The API web interface in Cisco Prime Infrastructure before 3
ghsa_unreviewed·2022-05-14
CVE-2016-1406 [HIGH] CWE-284 GHSA-h7gf-vcf5-w2p6: The API web interface in Cisco Prime Infrastructure before 3
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2016-05-25
Published