CVE-2016-6411

CWE-20 — Improper Input Validation4 documents4 sources

Severity

7.5HIGH

EPSS

0.2%

top 57.02%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Firesight System Software

Timeline

PublishedSep 24

Latest updateMay 17

Description

Cisco Firepower Management Center and FireSIGHT System Software 6.0.1 mishandle comparisons between URLs and X.509 certificates, which allows remote attackers to bypass intended do-not-decrypt settings via a crafted URL, aka Bug ID CSCva50585.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDcisco/firesight_system_software6.0.1

🔴Vulnerability Details

GHSA

GHSA-63j8-fpcg-99f3: Cisco Firepower Management Center and FireSIGHT System Software 6↗2022-05-17

▶

CVEList

CVE-2016-6411: Cisco Firepower Management Center and FireSIGHT System Software 6↗2016-09-24

▶

📋Vendor Advisories

Cisco

Cisco Firepower Management Center and FireSIGHT System Software SSLIinspection Bypass Vulnerability↗2016-09-21

▶