Unscored severity · published Jun 12, 2015
CVE-2015-0768
The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows…
–
CVSS
2.1%
EPSS
No
On KEV
Description
The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PN
Prime Network Control System · Cisco
2.1(0.0.85); 2.2(0.0.58); 2.2(0.0.69) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0768
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0768
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=39192
Third Party Advisory
http://www.securitytracker.com/id/1032541
More from Prime Network Control System
–
CVE-2012-5990
Multiple cross-site scripting (XSS) vulnerabilities in Health Monitor Login pages in Cisco Prime Network Control System (NCS) and Wireless Control System (WCS) allow remote…
–
CVE-2013-1196
The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime…
–
CVE-2013-1170
The Cisco Prime Network Control System (NCS) appliance with software before 1.1.1.24 has a default password for the database user account, which makes it easier for remote…
–
CVE-2013-1125
The command-line interface in Cisco Identity Services Engine Software, Secure Access Control System (ACS), Application Networking Manager (ANM), Prime LAN Management Solution…