fkie_cve-2016-1366
Vulnerability from fkie_nvd
Published
2016-03-24 22:59
Modified
2025-04-12 10:46
Severity ?
Summary
The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows remote authenticated users to cause a denial of service (overwrite) via unspecified vectors, aka Bug ID CSCuw75848.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xr:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F7620A88-C4B3-4184-846F-1E3FD8A751EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:ios_xr:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96BFB5A5-EF04-4334-9A62-558A375DE768",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:ios_xr:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "95175A2E-14DB-4730-93EA-2291ED7E0DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:ios_xr:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E5EFC65A-C469-4267-9C0B-DD25E2E8C0F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:ios_xr:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7DABC2A4-B161-4597-B053-0ECEFCCDD89F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:cisco:ios_xr:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A0B5C0F4-1BEC-4B54-ABF0-948CFF80E5E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows remote authenticated users to cause a denial of service (overwrite) via unspecified vectors, aka Bug ID CSCuw75848."
},
{
"lang": "es",
"value": "Los m\u00f3dulos SCP y SFTP en Cisco IOS XR 5.0.0 hasta la versi\u00f3n 5.2.5 en dispositivos Network Convergence System 6000 utilizan permisos d\u00e9biles para archivos de sistema, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio (sobrescritura) a trav\u00e9s de vectores no especificados, tambi\u00e9n conocida como Bug ID CSCuw75848."
}
],
"id": "CVE-2016-1366",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"confidentialityImpact": "NONE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-03-24T22:59:00.953",
"references": [
{
"source": "psirt@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-ncs"
},
{
"source": "psirt@cisco.com",
"url": "http://www.securitytracker.com/id/1035407"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-ncs"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1035407"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…