CVE-2016-6406 Cisco IronPort AsyncOS 9.1.2-023, 9.1.2-028, 9.1.2-036, 9.7.2-046, 9.7.2-047, 9.7.2-054, 10.0.0-124, and 10.0.0-125 on Email Security Appliance (ESA) devices, when Enrollment Client before 1.0.2-065 i...
CriticalCVSS 9.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cisco IronPort AsyncOS 9.1.2-023, 9.1.2-028, 9.1.2-036, 9.7.2-046, 9.7.2-047, 9.7.2-054, 10.0.0-124, and 10.0.0-125 on Email Security Appliance (ESA) devices, when Enrollment Client before 1.0.2-065 is installed, allows remote attackers to obtain root access via a connection to the testing/debugging interface, aka Bug ID CSCvb26017.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco email security appliance firmware | = 9.1.2-023 | No fix listed |
| cisco email security appliance firmware | = 9.1.2-028 | No fix listed |
| cisco email security appliance firmware | = 9.1.2-036 | No fix listed |
| cisco email security appliance firmware | = 9.7.2-046 | No fix listed |
| cisco email security appliance firmware | = 9.7.2-047 | No fix listed |
| cisco email security appliance firmware | = 9.7.2-054 | No fix listed |
| cisco email security appliance firmware | = 10.0.0-124 | No fix listed |
| cisco email security appliance firmware | = 10.0.0-125 | No fix listed |
References
- 20160922 Cisco Email Security Appliance Internal Testing Interface Vulnerability vendor-advisory
- 93116 third-party-advisory vdb-entry
- 1036881 vdb-entry