« Volver al listado

CVE-2016-1297

Estado: ModificadaAlta (8.8)—

The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Application Control Engine Software

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-1297",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-02-26T05:59:00.130",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-ace",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1035104",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-ace",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1035104",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801."
    },
    {
      "lang": "es",
      "value": "El Device Manager GUI en Cisco Application Control Engine (ACE) 4710 A5 en versiones anteriores a A5(3.1) permite a usuarios remotos autenticados eludir las restricciones RBAC previstas y ejecutar comandos CLI arbitrarios con privilegios de administrador a través de un parámetro no especificado en una petición POST, también conocida como Bug ID CSCul84801."
    }
  ],
  "lastModified": "2026-06-17T00:41:40.173",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:application_control_engine_software:a5\\(1.0\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B30ACF96-F3BB-48C6-8CC8-06305F04D137"
            },
            {
              "criteria": "cpe:2.3:a:cisco:application_control_engine_software:a5\\(1.1\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AB819FC-9181-4625-8679-FC413FEEB771"
            },
            {
              "criteria": "cpe:2.3:a:cisco:application_control_engine_software:a5\\(1.2\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16C9EBEB-23D0-4894-9CE8-2B09BADDDFCF"
            },
            {
              "criteria": "cpe:2.3:a:cisco:application_control_engine_software:a5\\(2.0\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B5BB899-2DC6-4EA2-897A-3293EA06DB58"
            },
            {
              "criteria": "cpe:2.3:a:cisco:application_control_engine_software:a5\\(2.1\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF2542D0-E96D-40AA-9352-CABC35FAE18E"
            },
            {
              "criteria": "cpe:2.3:a:cisco:application_control_engine_software:a5\\(2.1e\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "227DD48F-F442-43B5-A417-D9DC7D461253"
            },
            {
              "criteria": "cpe:2.3:a:cisco:application_control_engine_software:a5\\(3.0\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "147FC771-0066-41A9-B750-31FD0DB20D63"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}