Low severity · published Nov 19, 2016
CVE-2016-6450
A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying…
2.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. This vulnerability affects the following products if they are running a vulnerable release of Cisco IOS XE Software: Cisco 5700 Series Wireless LAN Controllers, Cisco Catalyst 3650 Series Switches, Cisco Catalyst 3850 Series Switches, Cisco Catalyst 4500E Series Switches, Cisco Catalyst 4500X Series Switches. More Information: CSCva60013 CSCvb22622. Known Affected Releases: 3.7(0) 16.4.1 Denali-16.1.3 Denali-16.2.2 Denali-16.3.1. Known Fixed Releases: 15.2(4)E3 16.1(2.208) 16.2(2.42) 16.3(1.22) 16.4(0.190) 16.5(0.29).
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IX
IOS XE · Cisco
3.6.2ae; 3.6.3e; 3.6.4e; 3.8.1e; 16.1.1; 16.1.2; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6450
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6450
www.securityfocus.com
http://www.securityfocus.com/bid/94340
www.securitytracker.com
http://www.securitytracker.com/id/1037299
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161115-iosxe
More from IOS XE
10.0
CVE-2023-20198
Cisco IOS XE Web UI Privilege Escalation Vulnerability
9.8
CVE-2018-0151
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
9.8
CVE-2017-3881
Cisco IOS and IOS XE Remote Code Execution Vulnerability
8.8
CVE-2018-0167
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
8.8
CVE-2017-6738
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability