CVE-2015-6383 - Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130

Back Back to CVE browser

HIGH

Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130

Published Dec 3, 2015

7.2

HIGH

CVSS 2.0

EPSS 0.38%

Description

Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-264

References (5)

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-asa
vendor-advisoryx_refsource_CISCOVendor Advisory
http://www.securityfocus.com/bid/78521
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1034277
vdb-entryx_refsource_SECTRACK
http://www.securitytracker.com/id/1034296
vdb-entryx_refsource_SECTRACK
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-6325
Advisory

Link	Providers	Tags
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-asa		vendor-advisoryx_refsource_CISCOVendor Advisory
http://www.securityfocus.com/bid/78521		vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1034277		vdb-entryx_refsource_SECTRACK
http://www.securitytracker.com/id/1034296		vdb-entryx_refsource_SECTRACK
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-6325		Advisory