Sign-up

ID

VAR-201609-0359


CVE

CVE-2016-6374


TITLE

Cisco Cloud Services Platform 2100 Vulnerabilities in arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2016-004893

DESCRIPTION

Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote attackers to execute arbitrary code via a crafted dnslookup command in an HTTP request, aka Bug ID CSCuz89093. An attacker can exploit this issue to execute arbitrary command on the affected system. This may aid in further attacks. This issue being tracked by Cisco Bug ID CSCuz89093

Trust: 1.98

sources: NVD: CVE-2016-6374 // JVNDB: JVNDB-2016-004893 // BID: 93095 // VULHUB: VHN-95194

AFFECTED PRODUCTS

vendor:ciscomodel:cloud services platform 2100scope:eqversion:2.0.0

Trust: 1.0

vendor:ciscomodel:cloud services platform 2100scope:eqversion:2.0

Trust: 0.8

vendor:ciscomodel:cloud services platform 2100scope:eqversion:2.0.0_base

Trust: 0.6

vendor:ciscomodel:cloud services platformscope:eqversion:21002.0

Trust: 0.3

vendor:ciscomodel:cloud services platformscope:neversion:21002.1

Trust: 0.3

sources: BID: 93095 // JVNDB: JVNDB-2016-004893 // CNNVD: CNNVD-201609-501 // NVD: CVE-2016-6374

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6374
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-6374
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201609-501
value: HIGH

Trust: 0.6

VULHUB: VHN-95194
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-6374
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-95194
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-6374
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2016-6374
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-95194 // JVNDB: JVNDB-2016-004893 // CNNVD: CNNVD-201609-501 // NVD: CVE-2016-6374

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-95194 // JVNDB: JVNDB-2016-004893 // NVD: CVE-2016-6374

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201609-501

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201609-501

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-004893

PATCH
title:cisco-sa-20160921-csp2100-2url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160921-csp2100-2
Trust: 0.8
title:Cisco Cloud Services Platform Fixes for remote command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64238
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-004893 // 
            
            
            
            CNNVD: CNNVD-201609-501

EXTERNAL IDS
db:NVDid:CVE-2016-6374
Trust: 2.8
db:BIDid:93095
Trust: 2.0
db:SECTRACKid:1036864
Trust: 1.1
db:JVNDBid:JVNDB-2016-004893
Trust: 0.8
db:CNNVDid:CNNVD-201609-501
Trust: 0.7
db:VULHUBid:VHN-95194
Trust: 0.1
sources:
            
            
            VULHUB: VHN-95194 // 
            
            
            
            BID: 93095 // 
            
            
            
            JVNDB: JVNDB-2016-004893 // 
            
            
            
            CNNVD: CNNVD-201609-501 // 
            
            
            
            NVD: CVE-2016-6374

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160921-csp2100-2
Trust: 2.0
url:http://www.securityfocus.com/bid/93095
Trust: 1.7
url:http://www.securitytracker.com/id/1036864
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6374
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6374
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-95194 // 
            
            
            
            BID: 93095 // 
            
            
            
            JVNDB: JVNDB-2016-004893 // 
            
            
            
            CNNVD: CNNVD-201609-501 // 
            
            
            
            NVD: CVE-2016-6374

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 93095

SOURCES
db:VULHUBid:VHN-95194
db:BIDid:93095
db:JVNDBid:JVNDB-2016-004893
db:CNNVDid:CNNVD-201609-501
db:NVDid:CVE-2016-6374

LAST UPDATE DATE
2025-04-13T23:22:20.221000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-95194date:2021-01-05T00:00:00
db:BIDid:93095date:2016-09-23T00:00:00
db:JVNDBid:JVNDB-2016-004893date:2016-09-28T00:00:00
db:CNNVDid:CNNVD-201609-501date:2016-09-23T00:00:00
db:NVDid:CVE-2016-6374date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-95194date:2016-09-22T00:00:00
db:BIDid:93095date:2016-09-21T00:00:00
db:JVNDBid:JVNDB-2016-004893date:2016-09-28T00:00:00
db:CNNVDid:CNNVD-201609-501date:2016-09-22T00:00:00
db:NVDid:CVE-2016-6374date:2016-09-22T22:59:21.223