Lucene search

[email protected]CVE-2015-6435

HistoryJan 22, 2016 - 11:59 a.m.

CVE-2015-6435

2016-01-2211:59:01

CWE-78

[email protected]

web.nvd.nist.gov

cisco

fx-os

ucs manager

cgi script

remote command execution

cve-2015-6435

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.0%

JSON

An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request, aka Bug ID CSCur90888.

Affected configurations

NVD

Node

ciscofirepower_extensible_operating_systemMatch1.1\(1.86\)

ciscofirepower_extensible_operating_systemMatch1.1\(1.160\)

ciscofirepower_extensible_operating_systemMatch1.1.1

Node

ciscounified_computing_systemMatch1.0\(2k\)

ciscounified_computing_systemMatch1.0_base

ciscounified_computing_systemMatch1.1\(1m\)

ciscounified_computing_systemMatch1.1_base

ciscounified_computing_systemMatch1.2\(1d\)

ciscounified_computing_systemMatch1.2_base

ciscounified_computing_systemMatch1.3\(1c\)

ciscounified_computing_systemMatch1.3\(1m\)

ciscounified_computing_systemMatch1.3\(1n\)

ciscounified_computing_systemMatch1.3\(1o\)

ciscounified_computing_systemMatch1.3\(1p\)

ciscounified_computing_systemMatch1.3\(1q\)

ciscounified_computing_systemMatch1.3\(1t\)

ciscounified_computing_systemMatch1.3\(1w\)

ciscounified_computing_systemMatch1.3\(1y\)

ciscounified_computing_systemMatch1.3_base

ciscounified_computing_systemMatch1.4\(1i\)

ciscounified_computing_systemMatch1.4\(1j\)

ciscounified_computing_systemMatch1.4\(1m\)

ciscounified_computing_systemMatch1.4\(3i\)

ciscounified_computing_systemMatch1.4\(3l\)

ciscounified_computing_systemMatch1.4\(3m\)

ciscounified_computing_systemMatch1.4\(3q\)

ciscounified_computing_systemMatch1.4\(3s\)

ciscounified_computing_systemMatch1.4\(3u\)

ciscounified_computing_systemMatch1.4\(3y\)

ciscounified_computing_systemMatch1.4\(4f\)

ciscounified_computing_systemMatch1.4\(4g\)

ciscounified_computing_systemMatch1.4\(4i\)

ciscounified_computing_systemMatch1.4\(4j\)

ciscounified_computing_systemMatch1.4\(4k\)

ciscounified_computing_systemMatch1.4_base

ciscounified_computing_systemMatch2.0\(1m\)

ciscounified_computing_systemMatch2.0\(1q\)

ciscounified_computing_systemMatch2.0\(1s\)

ciscounified_computing_systemMatch2.0\(1t\)

ciscounified_computing_systemMatch2.0\(1w\)

ciscounified_computing_systemMatch2.0\(1x\)

ciscounified_computing_systemMatch2.0\(2m\)

ciscounified_computing_systemMatch2.0\(2q\)

ciscounified_computing_systemMatch2.0\(2r\)

ciscounified_computing_systemMatch2.0\(3a\)

ciscounified_computing_systemMatch2.0\(3b\)

ciscounified_computing_systemMatch2.0\(3c\)

ciscounified_computing_systemMatch2.0\(4a\)

ciscounified_computing_systemMatch2.0\(4b\)

ciscounified_computing_systemMatch2.0\(4d\)

ciscounified_computing_systemMatch2.0\(5a\)

ciscounified_computing_systemMatch2.0\(5b\)

ciscounified_computing_systemMatch2.0\(5c\)

ciscounified_computing_systemMatch2.0_base

ciscounified_computing_systemMatch2.1\(1a\)

ciscounified_computing_systemMatch2.1\(1b\)

ciscounified_computing_systemMatch2.1\(1d\)

ciscounified_computing_systemMatch2.1\(1e\)

ciscounified_computing_systemMatch2.1\(1f\)

ciscounified_computing_systemMatch2.1\(2a\)

ciscounified_computing_systemMatch2.1_base

ciscounified_computing_systemMatch2.2\(1b\)

ciscounified_computing_systemMatch2.2\(1c\)

ciscounified_computing_systemMatch2.2\(1d\)

ciscounified_computing_systemMatch2.2\(1e\)

ciscounified_computing_systemMatch2.2\(1f\)

ciscounified_computing_systemMatch2.2\(1g\)

ciscounified_computing_systemMatch2.2\(1h\)

ciscounified_computing_systemMatch2.2\(2c\)

ciscounified_computing_systemMatch2.2\(2c\)a

ciscounified_computing_systemMatch2.2\(3a\)

ciscounified_computing_systemMatch2.2\(3b\)

ciscounified_computing_systemMatch2.2\(3c\)

ciscounified_computing_systemMatch2.2\(3d\)

ciscounified_computing_systemMatch2.2\(3e\)

ciscounified_computing_systemMatch2.2\(3f\)

ciscounified_computing_systemMatch2.2\(3g\)

ciscounified_computing_systemMatch2.2\(4b\)

ciscounified_computing_systemMatch2.2\(4c\)

ciscounified_computing_systemMatch2.2\(5a\)

ciscounified_computing_systemMatch2.2_base

ciscounified_computing_systemMatch3.0\(1c\)

ciscounified_computing_systemMatch3.0\(1d\)

ciscounified_computing_systemMatch3.0\(1e\)

ciscounified_computing_systemMatch3.0\(2c\)

ciscounified_computing_systemMatch3.0\(2d\)

CPENameOperatorVersion
cisco:firepower_extensible_operating_systemcisco firepower extensible operating systemeq1.1\(1.86\)
cisco:firepower_extensible_operating_systemcisco firepower extensible operating systemeq1.1\(1.160\)
cisco:firepower_extensible_operating_systemcisco firepower extensible operating systemeq1.1.1

CPE	Name	Operator	Version
cisco:firepower_extensible_operating_system	cisco firepower extensible operating system	eq	1.1\(1.86\)
cisco:firepower_extensible_operating_system	cisco firepower extensible operating system	eq	1.1\(1.160\)
cisco:firepower_extensible_operating_system	cisco firepower extensible operating system	eq	1.1.1

References

packetstormsecurity.com/files/160991/Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution.html

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-ucsm

www.securitytracker.com/id/1034743

Social References

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.0%

JSON

Related for CVE-2015-6435

nessus2 openvas1 packetstorm1 nvd1 prion1 cvelist1 cisco1