Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-6433 — Improper Input Validation in Cisco Secure Firewall Management Center

CWE-20 — Improper Input Validation7 documents6 sources
Severity
8.8HIGHNVD
EPSS
69.7%
top 1.33%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Cisco Secure Firewall Management Center
Timeline
PublishedOct 6
Latest updateMay 13

Description

The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-vj79-frfw-249q: The Threat Management Console in Cisco Firepower Management Center 5↗2022-05-13
▶
CVEList
CVE-2016-6433: The Threat Management Console in Cisco Firepower Management Center 5↗2016-10-06
▶

💥Exploits & PoCs

3
Exploit-DB
Cisco Firepower Management Console 6.0 - Post Authentication UserAdd (Metasploit)↗2017-01-13
▶
Exploit-DB
Cisco Firepower Threat Management Console 6.0.1 - Remote Command Execution↗2016-10-05
▶
Metasploit
Cisco Firepower Management Console 6.0 Post Authentication UserAdd Vulnerability↗
▶

📋Vendor Advisories

1
Cisco
Cisco Firepower Threat Management Console Remote Command Execution Vulnerability↗2016-10-05
▶
CVE-2016-6433 — Improper Input Validation in Cisco | cvebase