CVE-2016-1289 The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information v...
CriticalCVSS 9.8
EPSS 6.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device credentials, aka Bug ID CSCuy10231.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco prime infrastructure | = 1.2 | No fix listed |
| cisco prime infrastructure | = 1.2.0.103 | No fix listed |
| cisco prime infrastructure | = 1.2.1 | No fix listed |
| cisco prime infrastructure | = 1.3 | No fix listed |
| cisco prime infrastructure | = 1.3.0.20 | No fix listed |
| cisco prime infrastructure | = 1.4 | No fix listed |
| cisco prime infrastructure | = 1.4.0.45 | No fix listed |
| cisco prime infrastructure | = 1.4.1 | No fix listed |
| cisco prime infrastructure | = 1.4.2 | No fix listed |
| cisco prime infrastructure | = 2.0 | No fix listed |
| cisco prime infrastructure | = 2.1.0 | No fix listed |
| cisco prime infrastructure | = 2.2 | No fix listed |
| cisco prime infrastructure | = 2.2(2) | No fix listed |
| cisco evolved programmable network manager | = 1.2.0 | No fix listed |
References
- 20160629 Cisco Prime Infrastructure and Evolved Programmable Network Manager Authentication Bypass API Vulnerability vendor-advisory
- 91504 vdb-entry
- 1036195 vdb-entry