CVE-2016-1452 Missing authorization in n/a
Remote attackers can modify device configuration via SNMP if they know the read-write community string, affecting Cisco ASR 5000 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-1452?
CVE-2016-1452 is a medium-severity missing authorization vulnerability in n/a, published on 15 Jul 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cisco ASR 5000 devices with software 18.3 through 20.0.0 allow remote attackers to make configuration changes over SNMP by leveraging knowledge of the read-write community, aka Bug ID CSCuz29526.
Which versions are affected by CVE-2016-1452?
It affects 2 products.
Products include Cisco Asr 5000, Cisco Asr 5000 Software.
How do I fix CVE-2016-1452?
No fix has been published for CVE-2016-1452 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-1452 being exploited?
There is no known exploitation of CVE-2016-1452 in the wild and no public exploit code.
Sources
Also known as GHSA-54mh-qp5h-jfpv.