← back
CVE-2016-6435

CVE-2016-6435

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 37%
from disclosure to weapon0 days
Published on NVDOct 6
1st PoCOct 5
metasploit+4d
exploitation probability
37%top 2% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376.
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/40464unverifiedcve_referencewww.exploit-db.com/exploits/40464/unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunkinghttps://www.exploit-db.com/exploits/40464/https://www.korelogic.com/Resources/Advisories/KL-001-2016-006.txthttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc2http://www.securityfocus.com/bid/93421