CVE-2016-6433

HIGH 8.8CVE-2016-6433 · Published 06/10/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
secure firewall management center cisco	`= 5.2.0= 5.3.0= 5.3.0.2= 5.3.0.3= 5.3.0.4= 5.3.1= 5.3.1.3= 5.3.1.4= 5.3.1.5= 5.3.1.6= 5.4.0= 5.4.0.2= 5.4.1= 5.4.1.1= 5.4.1.2= 5.4.1.3= 5.4.1.4= 5.4.1.5= 5.4.1.6= 6.0.1`	No fix yet

Description

The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.

References

packetstormsecurity.com/files/140467/Cisco-Firepower-Management-Console-6.0-Post-Authentication-UserAdd.html · Third Party Advisory
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc · Vendor Advisory
securityfocus.com/bid/93414 · Third Party Advisory
blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking · Third Party Advisory
exploit-db.com/exploits/40463 · Third Party Advisory
exploit-db.com/exploits/41041 · Third Party Advisory
korelogic.com/Resources/Advisories/KL-001-2016-007.txt · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free