CVE-2016-1335: High severity cisco asr 5000 series aggregation services routers vulnerability
The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previously used for an administrator's connection, aka Bug ID CSCux22492.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1335?
CVE-2016-1335 is classified as a high-severity vulnerability due to its potential to allow remote authenticated users to gain unauthorized privileges.
How do I fix CVE-2016-1335?
To fix CVE-2016-1335, upgrade your Cisco ASR 5000 Series software to version 19.3.M0.62771 or 20.0.M0.62768 or later.
Which Cisco ASR 5000 software versions are affected by CVE-2016-1335?
CVE-2016-1335 affects Cisco ASR 5000 Series software versions 16.5.2, 17.7.0, 18.4.0, 19.0.1, 19.3.0, and 20.0.0 before specified patches.
What type of devices are impacted by CVE-2016-1335?
CVE-2016-1335 impacts Cisco ASR 5000 Series devices that utilize the SSH implementation.
Can CVE-2016-1335 be exploited remotely?
Yes, CVE-2016-1335 can be exploited remotely by authenticated users who connect from previously compromised endpoints.