« Volver al listado

CVE-2016-1391

Estado: ModificadaAlta (8.8)—

Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21889.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Cisco — Prime Network Analysis Module SoftwareCisco — Prime Virtual Network Analysis Module Software

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-1391",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-06-04T01:59:03.897",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1036014",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160601-prime2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1036014",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21889."
    },
    {
      "lang": "es",
      "value": "Cisco Prime Network Analysis Module (NAM) en versiones anteriores a 6.1(1) patch.6.1-2-final y 6.2.x en versiones anteriores a 6.2(2) y Prime Virtual Network Analysis Module (vNAM) en versiones anteriores a 6.1(1) patch.6.1-2-final y 6.2.x en versiones anteriores a 6.2(2) permite a usuarios remotos autenticados ejecutar comandos de SO arbitrarios a través de una petición HTTP manipulada, también conocido como Bug ID CSCuy21889."
    }
  ],
  "lastModified": "2026-06-17T00:41:51.177",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0955267-3FDE-4042-957D-61A152E707BE"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52E9EE0D-18B8-4A89-A46B-F413F6B3326D"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DE4C703-7592-4311-80C3-45D3B28D77AE"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA6635D7-E0AA-42E6-96B5-09DF222CA667"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:5.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "511F8596-F154-4DF0-AC91-3316FB38E6B5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:6.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F948B4B-BCB3-4980-9730-62A4177AB741"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "873CA00E-B24B-405C-9C49-B0901BCC17B6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:6.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "843EA4B8-E382-4515-9536-CB35752848A0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_network_analysis_module_software:6.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85DAB7B9-61BE-4E79-8279-2751CFC9A9E3"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_virtual_network_analysis_module_software:6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15879057-5B4A-4B0C-878B-7C7311B1AA1A"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_virtual_network_analysis_module_software:6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "859B0C5B-66AD-4436-9C35-7DEB7B83E547"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_virtual_network_analysis_module_software:6.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B2302EC-BCE4-4B67-BFAD-DC707E844F09"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_virtual_network_analysis_module_software:6.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4464E2B5-9C6B-4F20-A72A-FCD1AFC0E7AE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}