CVE-2016-6397 Auth bypass in Cisco IPICS 4.8(1) to 4.10(1)
Unauthenticated remote attackers can modify configuration parameters and cause denial of service in Cisco IPICS UMS due to authentication bypass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6397?
CVE-2016-6397 is a critical authentication bypass vulnerability in Cisco IPICS 4.8(1) to 4.10(1), published on 28 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Media Services (UMS) could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable. Affected Products: This vulnerability affects Cisco IPICS releases 4.8(1) to 4.10(1). More Information: CSCva46644. Known Affected Releases: 4.10(1) 4.8(1) 4.8(2) 4.9(1) 4.9(2).
Weakness: CWE-287
Which versions are affected by CVE-2016-6397?
It affects 1 product.
Products include Cisco Ip Interoperability and Collaboration System.
How do I fix CVE-2016-6397?
No fix has been published for CVE-2016-6397 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-6397 being exploited?
There is no known exploitation of CVE-2016-6397 in the wild and no public exploit code.
Other vulnerabilities in Cisco IPICS 4.8(1) to 4.10(1)
Sources
Also known as GHSA-9fq7-3gmm-wjpp.