CVE-2015-6401
HighSummary
Cisco EPC3928 devices with EDVA versions 5.5.10, 5.5.11, and 5.7.1 allow remote attackers to bypass an intended authentication requirement and execute unspecified administrative functions via a crafted HTTP request.
Risk Assessment
Attackers may gain access to administrative functions of the device, potentially leading to serious security breaches within the organization's network.
Recommendation
It is recommended to update the devices to the latest software version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Cisco EPC3928
See all- CVE-2016-1337High
Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot process, related to a 'Boot Information Disclosure' issue.
- CVE-2016-1336High
CVE-2016-1336 affects Cisco EPC3928 devices, where remote attackers can cause a device crash by sending a long LanguageSelect parameter. This issue is related to a 'Gateway HTTP Corruption Denial of Service' problem.
- CVE-2016-1328High
CVE-2016-1328 affects Cisco EPC3928 devices, where remote attackers can cause a device crash by sending an overly long h_sortWireless parameter in a goform/WClientMACList request.
Original NVD description (English source)
Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allow remote attackers to bypass an intended authentication requirement and execute unspecified administrative functions via a crafted HTTP request, aka Bug ID CSCux24941.