20160921 Cisco Cloud Services Platform 2100 Command Injection Vulnerability

93093

1036865

According to its self-reported version number, the remote Cisco Cloud Services Platform (CSP) device is 2.x prior to 2.1.0. It is, therefore, affected by the following vulnerabilities :

  - A command injection vulnerability exists in the     web-based GUI due to improper sanitization of     user-supplied input. An authenticated, remote attacker     can exploit this to execute arbitrary operating system     commands with root privileges. (CVE-2016-6373)

  - A remote code execution vulnerability exists in the     web-based GUI due to improper sanitization of     user-supplied data from HTTP requests. An     unauthenticated, remote attacker can exploit this, via a     crafted dnslookup command in an HTTP request, to execute     arbitrary code. (CVE-2016-6374)

CVE-2016-6373

high

Tenable Plugins

high