Details of VAR-201610-0287

ID

VAR-201610-0287

CVE

CVE-2016-6438

TITLE

Cisco cBR-8 Converged Broadband Runs on the router IOS XE In software vty Line configuration integrity vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-005693

DESCRIPTION

A vulnerability in Cisco IOS XE Software running on Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause a configuration integrity change to the vty line configuration on an affected device. This vulnerability affects the following releases of Cisco IOS XE Software running on Cisco cBR-8 Converged Broadband Routers: All 3.16S releases, All 3.17S releases, Release 3.18.0S, Release 3.18.1S, Release 3.18.0SP. More Information: CSCuz62815. Known Affected Releases: 15.5(3)S2.9, 15.6(2)SP. Known Fixed Releases: 15.6(1.7)SP1, 16.4(0.183), 16.5(0.1). Vendors have confirmed this vulnerability Bug ID CSCuz62815 It is released as.By a third party vty It may be possible to induce changes in integrity settings for line settings. Cisco IOSXE is an operating system developed by Cisco Systems for its network devices. A remote security bypass vulnerability exists in version 3.18 of Cisco IOSXE. An attacker could exploit the vulnerability to bypass security restrictions and perform unauthorized actions or to initiate further attacks. This may aid in further attacks. This issue is tracked by Cisco Bug ID CSCuz62815

Trust: 2.52

sources: NVD: CVE-2016-6438 // JVNDB: JVNDB-2016-005693 // CNVD: CNVD-2016-09473 // BID: 93518 // VULHUB: VHN-95258

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-09473

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	eq	version:	3.18.0s	Trust: 2.4
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.18.1s	Trust: 2.4
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.18.0sp	Trust: 1.8
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.17.1s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.2s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.4s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.17.2s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.0s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.3s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.0cs	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.3as	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.1as	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.2bs	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.17.0s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.17.1as	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16.2as	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.16s all releases	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.17s all releases	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.18	Trust: 0.6
vendor:	cisco	model:	ios xe 3.18.1s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.18.0sp	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.18.0s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.17s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.16s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	cbr-8	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2016-09473 // BID: 93518 // JVNDB: JVNDB-2016-005693 // CNNVD: CNNVD-201610-806 // NVD: CVE-2016-6438

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-6438
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2016-6438
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2016-09473
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201610-806
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-95258
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-6438
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-09473
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-95258
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-6438
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2016-09473 // VULHUB: VHN-95258 // JVNDB: JVNDB-2016-005693 // CNNVD: CNNVD-201610-806 // NVD: CVE-2016-6438

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 1.9

sources: VULHUB: VHN-95258 // JVNDB: JVNDB-2016-005693 // NVD: CVE-2016-6438

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201610-806

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201610-806

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-005693

PATCH

title:	cisco-sa-20161012-cbr-8	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-cbr-8	Trust: 0.8
title:	Cisco IOSXE Remote Security Bypass Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/82543	Trust: 0.6
title:	Cisco IOS XE on cBR-8 Converged Broadband Router Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65158	Trust: 0.6

sources: CNVD: CNVD-2016-09473 // JVNDB: JVNDB-2016-005693 // CNNVD: CNNVD-201610-806

EXTERNAL IDS

db:	NVD	id:	CVE-2016-6438	Trust: 3.4
db:	BID	id:	93518	Trust: 2.0
db:	SECTRACK	id:	1037003	Trust: 1.1
db:	JVNDB	id:	JVNDB-2016-005693	Trust: 0.8
db:	CNNVD	id:	CNNVD-201610-806	Trust: 0.7
db:	CNVD	id:	CNVD-2016-09473	Trust: 0.6
db:	VULHUB	id:	VHN-95258	Trust: 0.1

sources: CNVD: CNVD-2016-09473 // VULHUB: VHN-95258 // BID: 93518 // JVNDB: JVNDB-2016-005693 // CNNVD: CNNVD-201610-806 // NVD: CVE-2016-6438

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20161012-cbr-8	Trust: 2.6
url:	http://www.securityfocus.com/bid/93518	Trust: 1.7
url:	http://www.securitytracker.com/id/1037003	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6438	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6438	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2016-09473 // VULHUB: VHN-95258 // BID: 93518 // JVNDB: JVNDB-2016-005693 // CNNVD: CNNVD-201610-806 // NVD: CVE-2016-6438

CREDITS

Cisco

Trust: 0.3

sources: BID: 93518

SOURCES

db:	CNVD	id:	CNVD-2016-09473
db:	VULHUB	id:	VHN-95258
db:	BID	id:	93518
db:	JVNDB	id:	JVNDB-2016-005693
db:	CNNVD	id:	CNNVD-201610-806
db:	NVD	id:	CVE-2016-6438

LAST UPDATE DATE

2024-11-23T23:02:33.007000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-09473	date:	2016-10-19T00:00:00
db:	VULHUB	id:	VHN-95258	date:	2017-07-29T00:00:00
db:	BID	id:	93518	date:	2016-10-26T02:05:00
db:	JVNDB	id:	JVNDB-2016-005693	date:	2016-11-04T00:00:00
db:	CNNVD	id:	CNNVD-201610-806	date:	2016-10-31T00:00:00
db:	NVD	id:	CVE-2016-6438	date:	2024-11-21T02:56:08.037

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-09473	date:	2016-10-19T00:00:00
db:	VULHUB	id:	VHN-95258	date:	2016-10-27T00:00:00
db:	BID	id:	93518	date:	2016-10-12T00:00:00
db:	JVNDB	id:	JVNDB-2016-005693	date:	2016-11-04T00:00:00
db:	CNNVD	id:	CNNVD-201610-806	date:	2016-10-31T00:00:00
db:	NVD	id:	CVE-2016-6438	date:	2016-10-27T21:59:09.810