CVE-2016-6408
HighSummary
Cisco Prime Home version 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Risk Assessment
Attackers may gain access to sensitive data on the server, potentially leading to a breach of confidentiality within the organization.
Recommendation
It is recommended to update Cisco Prime Home to the latest version to mitigate this vulnerability and implement appropriate security measures to protect against XXE attacks.
Other vulnerabilities in Cisco Prime Home 5.2.0
See all- CVE-2017-3791Critical
A vulnerability in the web-based GUI of Cisco Prime Home allows an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The issue is due to a processing error in the role-based access control (RBAC) of URLs.
- CVE-2016-6452Critical
A vulnerability in the web-based graphical user interface of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges.
Original NVD description (English source)
Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCvb17814.