CVE-2016-9209 Security feature bypass in Cisco FirePOWER
Unauthenticated remote attackers can bypass file blocking mechanisms in Cisco FirePOWER systems to download restricted files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2016-9209?
CVE-2016-9209 is a medium-severity vulnerability in Cisco FirePOWER, published on 14 Dec 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in TCP processing in Cisco FirePOWER system software could allow an unauthenticated, remote attacker to download files that would normally be blocked. Affected Products: The following Cisco products are vulnerable: Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services, Advanced Malware Protection (AMP) for Networks - 7000 Series Appliances, Advanced Malware Protection (AMP) for Networks - 8000 Series Appliances, FirePOWER 7000 Series Appliances, FirePOWER 8000 Series Appliances, FirePOWER Threat Defense for Integrated Services Routers (ISRs), Next Generation Intrusion Prevention System (NGIPS) for Blue Coat X-Series, Sourcefire 3D System Appliances, Virtual Next-Generation Intrusion Prevention System (NGIPSv) for VMware. More Information: CSCvb20102. Known Affected Releases: 2.9.7.10.
Weakness: CWE-254
Which versions are affected by CVE-2016-9209?
It affects 1 product.
Products include Cisco Firepower Services for Adaptive Security Appliance.
How do I fix CVE-2016-9209?
No fix has been published for CVE-2016-9209 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-9209 being exploited?
There is no known exploitation of CVE-2016-9209 in the wild and no public exploit code.
Sources
Also known as GHSA-w647-wmr2-37vx.