CVE-2016-6452 Auth bypass in Cisco Prime Home before 6.0
Unauthenticated remote attackers can bypass authentication in Cisco Prime Home GUI to gain full administrator privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6452?
CVE-2016-6452 is a critical authentication bypass vulnerability in Cisco Prime Home before 6.0, published on 3 Nov 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web-based graphical user interface (GUI) of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges. Cisco Prime Home versions 5.1.1.6 and earlier and 5.2.2.2 and earlier have been confirmed to be vulnerable. Cisco Prime Home versions 6.0 and later are not vulnerable. More Information: CSCvb71732. Known Affected Releases: 5.0 5.0(1) 5.0(1.1) 5.0(1.2) 5.0(2) 5.15.1(0) 5.1(1) 5.1(1.3) 5.1(1.4) 5.1(1.5) 5.1(1.6) 5.1(2) 5.1(2.1) 5.1(2.3) 5.25.2(0.1) 5.2(1.0) 5.2(1.2) 5.2(2.0) 5.2(2.1) 5.2(2.2).
Weakness: CWE-287
Which versions are affected by CVE-2016-6452?
It affects 1 product.
Products include Cisco Prime Home.
How do I fix CVE-2016-6452?
No fix has been published for CVE-2016-6452 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-6452 being exploited?
There is no known exploitation of CVE-2016-6452 in the wild and no public exploit code.
Other vulnerabilities in Cisco Prime Home before 6.0
Sources
Also known as GHSA-cq4x-jvjg-rq7m.