Lucene search

CiscoCVE-2016-9196

HistoryApr 07, 2017 - 5:59 p.m.

CVE-2016-9196

2017-04-0717:59:00

CWE-264

cisco

web.nvd.nist.gov

cisco

aironet

access point

vulnerability

root access

authentication

linux

cve-2016-9196.

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in login authentication management in Cisco Aironet 1800, 2800, and 3800 Series Access Point platforms could allow an authenticated, local attacker to gain unrestricted root access to the underlying Linux operating system. The root Linux shell is provided for advanced troubleshooting and should not be available to individual users, even those with root privileges. The attacker must have the root password to exploit this vulnerability. More Information: CSCvb13893. Known Affected Releases: 8.2(121.0) 8.3(102.0). Known Fixed Releases: 8.4(1.53) 8.4(1.52) 8.3(111.0) 8.3(104.23) 8.2(130.0) 8.2(124.1).

Affected configurations

Nvd

Node

ciscoaironet_access_pointMatch8.1\(15.14\)

ciscoaironet_access_pointMatch8.1\(112.3\)

ciscoaironet_access_pointMatch8.1\(112.4\)

ciscoaironet_access_pointMatch8.1\(131.0\)

ciscoaironet_access_pointMatch8.2\(100.0\)

ciscoaironet_access_pointMatch8.2\(102.43\)

ciscoaironet_access_pointMatch8.2_base

AND

ciscoaironet_1800Match-

ciscoaironet_2800eMatch-

ciscoaironet_2800iMatch-

ciscoaironet_3800eMatch-

ciscoaironet_3800iMatch-

ciscoaironet_3800pMatch-

VendorProductVersionCPE
ciscoaironet_access_point8.1(15.14)cpe:2.3:o:cisco:aironet_access_point:8.1\(15.14\):*:*:*:*:*:*:*
ciscoaironet_access_point8.1(112.3)cpe:2.3:o:cisco:aironet_access_point:8.1\(112.3\):*:*:*:*:*:*:*
ciscoaironet_access_point8.1(112.4)cpe:2.3:o:cisco:aironet_access_point:8.1\(112.4\):*:*:*:*:*:*:*
ciscoaironet_access_point8.1(131.0)cpe:2.3:o:cisco:aironet_access_point:8.1\(131.0\):*:*:*:*:*:*:*
ciscoaironet_access_point8.2(100.0)cpe:2.3:o:cisco:aironet_access_point:8.2\(100.0\):*:*:*:*:*:*:*
ciscoaironet_access_point8.2(102.43)cpe:2.3:o:cisco:aironet_access_point:8.2\(102.43\):*:*:*:*:*:*:*
ciscoaironet_access_point8.2_basecpe:2.3:o:cisco:aironet_access_point:8.2_base:*:*:*:*:*:*:*
ciscoaironet_1800-cpe:2.3:h:cisco:aironet_1800:-:*:*:*:*:*:*:*
ciscoaironet_2800e-cpe:2.3:h:cisco:aironet_2800e:-:*:*:*:*:*:*:*
ciscoaironet_2800i-cpe:2.3:h:cisco:aironet_2800i:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	aironet_access_point	8.1(15.14)	cpe:2.3:o:cisco:aironet_access_point:8.1\(15.14\):::::::*
cisco	aironet_access_point	8.1(112.3)	cpe:2.3:o:cisco:aironet_access_point:8.1\(112.3\):::::::*
cisco	aironet_access_point	8.1(112.4)	cpe:2.3:o:cisco:aironet_access_point:8.1\(112.4\):::::::*
cisco	aironet_access_point	8.1(131.0)	cpe:2.3:o:cisco:aironet_access_point:8.1\(131.0\):::::::*
cisco	aironet_access_point	8.2(100.0)	cpe:2.3:o:cisco:aironet_access_point:8.2\(100.0\):::::::*
cisco	aironet_access_point	8.2(102.43)	cpe:2.3:o:cisco:aironet_access_point:8.2\(102.43\):::::::*
cisco	aironet_access_point	8.2_base	cpe:2.3:o:cisco:aironet_access_point:8.2_base:::::::*
cisco	aironet_1800	-	cpe:2.3:h:cisco:aironet_1800:-:::::::*
cisco	aironet_2800e	-	cpe:2.3:h:cisco:aironet_2800e:-:::::::*
cisco	aironet_2800i	-	cpe:2.3:h:cisco:aironet_2800i:-:::::::*

Rows per page:

1-10 of 131

CNA Affected

[
  {
    "product": "Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms"
      }
    ]
  }
]

References

www.securityfocus.com/bid/97468

www.securitytracker.com/id/1038187

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-aironet

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2016-9196