Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.8epss 98%
from disclosure to weapon1 days
Published on NVDMay 16
1st PoC+1d
metasploitMay 15
VulnCheck+1644d
exploitation probability
98%top 1% of all CVEs
observed exploitation
yesVulnCheck
5 public exploit(s)
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco Prime Infrastructurepublic PoCs found — 5✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47016exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47686githubgithub.com/k8gege/CiscoExploit★ 144cve_referencepacketstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.htmlunverifiedvulncheckvulncheck.com/xdb/af7753f2b014unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.