CVE-2016-1291
CriticalSummary
Cisco Prime Infrastructure versions 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) version 1.2 are vulnerable to remote code execution by attackers who can exploit crafted deserialized data in an HTTP POST request.
Risk Assessment
Attackers can remotely execute arbitrary code, potentially leading to system takeover and data leakage.
Recommendation
It is recommended to upgrade to the latest software version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in Cisco Prime Infrastructure, Cisco Evolved Programmable Network Manager
See all- CVE-2016-1406High
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, consequently gaining privileges.
- CVE-2016-1290High
The web API in Cisco Prime Infrastructure versions 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter.
Original NVD description (English source)
Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192.