CVE-2016-6433: Input Validation
Published Oct 6, 2016
·Updated
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.
Affected Software
40 affected components
Cisco Secure Firewall Management Center=5.2.0
Cisco Secure Firewall Management Center=5.3.0
Cisco Secure Firewall Management Center=5.3.0.2
Cisco Secure Firewall Management Center=5.3.0.3
Cisco Secure Firewall Management Center=5.3.0.4
Cisco Secure Firewall Management Center=5.3.1
Cisco Secure Firewall Management Center=5.3.1.3
Cisco Secure Firewall Management Center=5.3.1.4
Cisco Secure Firewall Management Center=5.3.1.5
Cisco Secure Firewall Management Center=5.3.1.6
Cisco Secure Firewall Management Center=5.4.0
Cisco Secure Firewall Management Center=5.4.0.2
Cisco Secure Firewall Management Center=5.4.1
Cisco Secure Firewall Management Center=5.4.1.1
Cisco Secure Firewall Management Center=5.4.1.2
Cisco Secure Firewall Management Center=5.4.1.3
Cisco Secure Firewall Management Center=5.4.1.4
Cisco Secure Firewall Management Center=5.4.1.5
Cisco Secure Firewall Management Center=5.4.1.6
Cisco Secure Firewall Management Center=6.0.1
Cisco FirePOWER Management Center=5.2.0
Cisco FirePOWER Management Center=5.3.0
Cisco FirePOWER Management Center=5.3.0.2
Cisco FirePOWER Management Center=5.3.0.3
Cisco FirePOWER Management Center=5.3.0.4
Cisco FirePOWER Management Center=5.3.1
Cisco FirePOWER Management Center=5.3.1.3
Cisco FirePOWER Management Center=5.3.1.4
Cisco FirePOWER Management Center=5.3.1.5
Cisco FirePOWER Management Center=5.3.1.6
Cisco FirePOWER Management Center=5.4.0
Cisco FirePOWER Management Center=5.4.0.2
Cisco FirePOWER Management Center=5.4.1
Cisco FirePOWER Management Center=5.4.1.1
Cisco FirePOWER Management Center=5.4.1.2
Cisco FirePOWER Management Center=5.4.1.3
Cisco FirePOWER Management Center=5.4.1.4
Cisco FirePOWER Management Center=5.4.1.5
Cisco FirePOWER Management Center=5.4.1.6
Cisco FirePOWER Management Center=6.0.1
Event History
Oct 6, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
via NVD·10:59 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6433?
CVE-2016-6433 has a high severity rating due to the potential for arbitrary command execution by remote authenticated users.
2
How do I fix CVE-2016-6433?
To fix CVE-2016-6433, Cisco recommends upgrading to a patched version of the Cisco Firepower Management Center.
3
Which versions are affected by CVE-2016-6433?
CVE-2016-6433 affects Cisco Firepower Management Center versions 5.2.0 through 6.0.1.
4
What kind of vulnerability is CVE-2016-6433?
CVE-2016-6433 is a command injection vulnerability that allows attackers to execute arbitrary commands.
5
Who can exploit CVE-2016-6433?
CVE-2016-6433 can be exploited by remote authenticated users with access to the Threat Management Console.