CVE-2016-9196
Summary
| CVE | CVE-2016-9196 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-04-07 17:59:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | A vulnerability in login authentication management in Cisco Aironet 1800, 2800, and 3800 Series Access Point platforms could allow an authenticated, local attacker to gain unrestricted root access to the underlying Linux operating system. The root Linux shell is provided for advanced troubleshooting and should not be available to individual users, even those with root privileges. The attacker must have the root password to exploit this vulnerability. More Information: CSCvb13893. Known Affected Releases: 8.2(121.0) 8.3(102.0). Known Fixed Releases: 8.4(1.53) 8.4(1.52) 8.3(111.0) 8.3(104.23) 8.2(130.0) 8.2(124.1). |
Risk And Classification
Primary CVSS: v3.0 6.7 MEDIUM from [email protected]
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-264 | Shell Bypass Vulnerability
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 6.7 | MEDIUM | CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
CVSS v3.0 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:L/AC:L/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Cisco | Aironet 1800 | - | All | All | All |
| Hardware | Cisco | Aironet 2800e | - | All | All | All |
| Hardware | Cisco | Aironet 2800i | - | All | All | All |
| Hardware | Cisco | Aironet 3800e | - | All | All | All |
| Hardware | Cisco | Aironet 3800i | - | All | All | All |
| Hardware | Cisco | Aironet 3800p | - | All | All | All |
| Operating System | Cisco | Aironet Access Point | 8.1\(112.3\) | All | All | All |
| Operating System | Cisco | Aironet Access Point | 8.1\(112.4\) | All | All | All |
| Operating System | Cisco | Aironet Access Point | 8.1\(131.0\) | All | All | All |
| Operating System | Cisco | Aironet Access Point | 8.1\(15.14\) | All | All | All |
| Operating System | Cisco | Aironet Access Point | 8.2\(100.0\) | All | All | All |
| Operating System | Cisco | Aironet Access Point | 8.2\(102.43\) | All | All | All |
| Operating System | Cisco | Aironet Access Point | 8.2_base | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | Cisco Aironet 1800 2800 And 3800 Series Access Point Platforms | affected Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco Aironet Access Points CVE-2016-9196 Local Privilege Escalation Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Cisco Aironet 1800/2800/3800 Series Access Points Lets Local Users Gain Elevated Privileges - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.