CVE-2016-1291
Summary
| CVE | CVE-2016-1291 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-04-06 23:59:11 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192. |
Risk And Classification
Primary CVSS: v3.0 9.8 CRITICAL from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-20 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:M/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Evolved Programmable Network Manager | 1.2.0 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.2 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.2.0.103 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.2.1 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.3 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.3.0.20 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.4 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.4.0.45 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.4.1 | All | All | All |
| Application | Cisco | Prime Infrastructure | 1.4.2 | All | All | All |
| Application | Cisco | Prime Infrastructure | 2.0 | All | All | All |
| Application | Cisco | Prime Infrastructure | 2.1.0 | All | All | All |
| Application | Cisco | Prime Infrastructure | 2.2 | All | All | All |
| Operating System | Sun | Opensolaris | snv_124 | All | sparc | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| Cisco Prime Infrastructure Deserialization Flaw Lets Remote Users Execute Arbitrary Code on the Target System - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| 401 Authorization Required | af854a3a-2127-422b-91ae-364da2661108 | blogs.securiteam.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 730721 Cisco Evolved Programmable Network Manager Improper Input Validation Vulnerbility