VYPR
Get started
← All advisories
High severity8.8NVD Advisory· Published May 25, 2016· Updated May 6, 2026

CVE-2016-1406

CVE-2016-1406

Description

The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.

Affected products

18
  • Cisco Systems, Inc./Prime Infrastructure14 versions
    cpe:2.3:a:cisco:prime_infrastructure:1.3:*:*:*:*:*:*:*+ 13 more
    • cpe:2.3:a:cisco:prime_infrastructure:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:1.3.0.20:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:1.4.0.45:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:1.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:2.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:2.2\(2\):*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:1.2.0.103:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:prime_infrastructure:1.2.1:*:*:*:*:*:*:*
  • Cisco Systems, Inc./Evolved Programmable Network Manager4 versions
    cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.200:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.300:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.