CVE-2015-4186

The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=39347	Vendor Advisory
http://www.securityfocus.com/bid/75195
http://www.securitytracker.com/id/1032583
http://tools.cisco.com/security/center/viewAlert.x?alertId=39347	Vendor Advisory
http://www.securityfocus.com/bid/75195
http://www.securitytracker.com/id/1032583

Configurations

Configuration 1 (hide)

cpe:2.3:o:cisco:virtualization_experience_client_6000_series_firmware:11.2\(27.4\):*:*:*:*:*:*:*

History

21 Nov 2024, 02:30

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=39347 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=39347 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/75195 -~~	() http://www.securityfocus.com/bid/75195 -
References	~~() http://www.securitytracker.com/id/1032583 -~~	() http://www.securitytracker.com/id/1032583 -

Information

Published : 2015-06-17 10:59

Updated : 2024-11-21 02:30

NVD link : CVE-2015-4186

Mitre link : CVE-2015-4186

CVE.ORG link : CVE-2015-4186

JSON object : View

Products Affected

cisco

virtualization_experience_client_6000_series_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2015-4186", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-06-17T10:59:04.883", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39347", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/75195", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1032583", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39347", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/75195", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1032583", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412."}, {"lang": "es", "value": "El subsistema de diagn\u00f3sticos en la interfaz web administrativa en los dispositivos Cisco Virtualization Experience (tambi\u00e9n conocidos como VXC) Client 6215 con 11.2(27.4) permite a usuarios locales ganar privilegios para la ejecuci\u00f3n de comandos del sistema operativo a trav\u00e9s de un valor de opci\u00f3n manipulado, tambi\u00e9n conocido como Bug ID CSCug54412."}], "lastModified": "2024-11-21T02:30:35.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:virtualization_experience_client_6000_series_firmware:11.2\\(27.4\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22F70C4F-040E-48CE-9919-829F3DA1607A"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}