Cisco Prime LAN Management Solution Java Object Deserialization RCE (CSCux34647)

Critical Nessus Plugin ID 99934


A network management system running on the remote host is affected by a remote code execution vulnerability.


The Cisco Prime Lan Management Solution (LMS) running on the remote web server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections (ACC) library. An unauthenticated, remote attacker can exploit this, by sending a crafted RMI request, to execute arbitrary code on the target host.


No release is planned by the vendor to fix this vulnerability.

See Also

Plugin Details

Severity: Critical

ID: 99934

File Name: cisco_prime_lms_java_deser.nasl

Version: $Revision: 1.2 $

Type: remote

Family: Misc.

Published: 2017/05/02

Modified: 2017/05/04

Dependencies: 22227, 64789

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:U/RC:C


Base Score: 9.8

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:U/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:prime_lan_management_solution

Required KB Items: installed_sw/cisco_lms

Exploit Available: false

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2015/01/28

Reference Information

CVE: CVE-2015-6420

BID: 78872

OSVDB: 131470


CERT: 576313