Vulnerability Description
The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device credentials, aka Bug ID CSCuy10231.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Prime Infrastructure | 1.2 |
| Cisco | Evolved Programmable Network Manager | 1.2.0 |
Related Weaknesses (CWE)
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20Vendor Advisory
- http://www.securityfocus.com/bid/91504
- http://www.securitytracker.com/id/1036195
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20Vendor Advisory
- http://www.securityfocus.com/bid/91504
- http://www.securitytracker.com/id/1036195
FAQ
What is CVE-2016-1289?
CVE-2016-1289 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information v...
How severe is CVE-2016-1289?
CVE-2016-1289 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-1289?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Prime Infrastructure, Cisco Evolved Programmable Network Manager.