CVE-2016-1408 Command injection in n/a
Remote authenticated attackers can execute arbitrary commands or upload files on Cisco Prime Infrastructure and EPNM via crafted HTTP requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-1408?
CVE-2016-1408 is a high-severity command injection vulnerability in Cisco Evolved Programmable Network Manager, published on 2 Jul 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to execute arbitrary commands or upload files via a crafted HTTP request, aka Bug ID CSCuz01488.
Weakness: CWE-20
Which versions are affected by CVE-2016-1408?
It affects 2 products.
Products include Cisco Evolved Programmable Network Manager, Cisco Prime Infrastructure.
How do I fix CVE-2016-1408?
No fix has been published for CVE-2016-1408 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-1408 being exploited?
There is no known exploitation of CVE-2016-1408 in the wild and no public exploit code.
Other vulnerabilities in Cisco Evolved Programmable Network Manager
- CVE-2016-1289 Code injection in n/a
- CVE-2016-1291 Deserialization in n/a
- CVE-2021-1487 Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Command Injection Vulnerability
- CVE-2019-1821 Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
- CVE-2019-1822 Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
All Cisco Evolved Programmable Network Manager vulnerabilities
Sources
Also known as GHSA-hcfc-q3x9-gc6f.