Lucene search

CiscoCVE-2015-6383

HistoryDec 03, 2015 - 3:59 a.m.

CVE-2015-6383

2015-12-0303:59:00

CWE-264

cisco

web.nvd.nist.gov

cisco

ios xe

asr 1000

license restrictions

root privileges

cve-2015-6383

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.6

Confidence

Low

EPSS

Percentile

5.1%

JSON

Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130.

Affected configurations

Nvd

Node

ciscoios_xeMatch15.4\(3\)s

VendorProductVersionCPE
ciscoios_xe15.4(3)scpe:2.3:o:cisco:ios_xe:15.4\(3\)s:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios_xe	15.4(3)s	cpe:2.3:o:cisco:ios_xe:15.4\(3\)s:::::::*

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-asa

www.securityfocus.com/bid/78521

www.securitytracker.com/id/1034277

www.securitytracker.com/id/1034296

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.6

Confidence

Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2015-6383