The web-based GUI in Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via crafted platform commands, aka Bug ID CSCva00541.

According to its self-reported version number, the remote Cisco Cloud Services Platform (CSP) device is 2.x prior to 2.1.0. It is, therefore, affected by the following vulnerabilities :

  - A command injection vulnerability exists in the     web-based GUI due to improper sanitization of     user-supplied input. An authenticated, remote attacker     can exploit this to execute arbitrary operating system     commands with root privileges. (CVE-2016-6373)

  - A remote code execution vulnerability exists in the     web-based GUI due to improper sanitization of     user-supplied data from HTTP requests. An     unauthenticated, remote attacker can exploit this, via a     crafted dnslookup command in an HTTP request, to execute     arbitrary code. (CVE-2016-6374)

Detections

Analytics

CVE-2016-6373

high

Tenable Plugins

high