« Volver al listado

CVE-2016-1388

Estado: ModificadaCrítica (9.8)—

Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21882.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Cisco — Network Analysis ModuleCisco — Prime Network Analysis Module SoftwareCisco — Prime Virtual Network Analysis Module Software

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-1388",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-06-03T02:01:07.613",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1036013",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1036013",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21882."
    },
    {
      "lang": "es",
      "value": "Cisco Prime Network Analysis Module (NAM) en versiones anteriores a 6.1(1) patch.6.1-2-final y 6.2.x en versiones anteriores a 6.2(1) y Prime Virtual Network Analysis Module (vNAM) en versiones anteriores a 6.1(1) patch.6.1-2-final y 6.2.x en versiones anteriores a 6.2(1) permiten a atacantes remotos ejecutar comandos de SO arbitrarios a través de una petición HTTP manipulada, también conocido como Bug ID CSCuy21882."
    }
  ],
  "lastModified": "2026-06-17T00:41:50.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:network_analysis_module:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD82BCCE-F68A-48A5-B484-98D9C3024E3A"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0955267-3FDE-4042-957D-61A152E707BE"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52E9EE0D-18B8-4A89-A46B-F413F6B3326D"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DE4C703-7592-4311-80C3-45D3B28D77AE"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA6635D7-E0AA-42E6-96B5-09DF222CA667"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "511F8596-F154-4DF0-AC91-3316FB38E6B5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:6.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F948B4B-BCB3-4980-9730-62A4177AB741"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "873CA00E-B24B-405C-9C49-B0901BCC17B6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:6.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "843EA4B8-E382-4515-9536-CB35752848A0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:6.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85DAB7B9-61BE-4E79-8279-2751CFC9A9E3"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_virtual_network_analysis_module_software:6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15879057-5B4A-4B0C-878B-7C7311B1AA1A"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_virtual_network_analysis_module_software:6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "859B0C5B-66AD-4436-9C35-7DEB7B83E547"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_virtual_network_analysis_module_software:6.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B2302EC-BCE4-4B67-BFAD-DC707E844F09"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}