CVE-2016-6468 Cross-site request forgery in Cisco Emergency Responder

What is CVE-2016-6468?

CVE-2016-6468 is a high-severity vulnerability in Cisco Emergency Responder, published on 14 Dec 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases: 11.5(1.10000.4). Known Fixed Releases: 12.0(0.98000.14).

Weakness: CWE-352

Which versions are affected by CVE-2016-6468?

It affects 1 product.

Products include Cisco Emergency Responder.

How do I fix CVE-2016-6468?

No fix has been published for CVE-2016-6468 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-6468 being exploited?

There is no known exploitation of CVE-2016-6468 in the wild and no public exploit code.

Other vulnerabilities in Cisco Emergency Responder

• CVE-2008-1154 Auth bypass in n/a Critical 10.0
• CVE-2023-20101 Hardcoded credentials in Cisco Emergency Responder Critical 9.8
• CVE-2017-12337 Hardcoded credentials in Cisco Voice Operating System Critical 9.8
• CVE-2023-20259 Denial of service in Cisco Emergency Responder High 8.6
• CVE-2017-6779 Denial of service in Multiple Cisco Products unknown High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r234-5c7f-3prg.