High severity · published Sep 22, 2016
CVE-2016-6414
iox in Cisco IOS, possibly 15.6 and earlier, and IOS XE, possibly 3.18 and earlier, allows local users to execute arbitrary IOx Linux commands on the guest OS via crafted iox…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
iox in Cisco IOS, possibly 15.6 and earlier, and IOS XE, possibly 3.18 and earlier, allows local users to execute arbitrary IOx Linux commands on the guest OS via crafted iox command-line options, aka Bug ID CSCuz59223.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IO
Ios · Cisco
15.6(1)t1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6414
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160921-iox
www.securityfocus.com
http://www.securityfocus.com/bid/93091
www.securitytracker.com
http://www.securitytracker.com/id/1036876
More from Ios
9.8
CVE-2018-0171
Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
9.8
CVE-2017-12240
Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
9.8
CVE-2017-3881
Cisco IOS and IOS XE Remote Code Execution Vulnerability
8.8
CVE-2018-0167
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
8.8
CVE-2017-6738
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability