high8.8Public exploit code
CVE-2016-6433
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via craf…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cisco Firepower Management Console 6.0 - Post Authentication UserAdd (Metasploit)2017-01-13 · remote · linux · Verified
- Cisco Firepower Threat Management Console 6.0.1 - Remote Command Execution2016-10-05 · webapps · cgi · Verified
Impact
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Secure Firewall Management Center | Versions 5.2.0, 5.3.0, 5.3.0.2, 5.3.0.3, 5.3.0.4, 5.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/140467/Cisco-Firepower-Management-Console-6.0-Post-Authentication-UserAdd.html
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc
- http://www.securityfocus.com/bid/93414
- https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking
- https://www.exploit-db.com/exploits/40463/
- https://www.exploit-db.com/exploits/41041/
- https://www.korelogic.com/Resources/Advisories/KL-001-2016-007.txt
- http://packetstormsecurity.com/files/140467/Cisco-Firepower-Management-Console-6.0-Post-Authentication-UserAdd.html
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc
- http://www.securityfocus.com/bid/93414
- https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking
- https://www.exploit-db.com/exploits/40463/
- https://www.exploit-db.com/exploits/41041/
- https://www.korelogic.com/Resources/Advisories/KL-001-2016-007.txt