#VU155 Command injection vulnerability - CVE-2016-1450

Vulnerability identifier: #VU155

Vulnerability risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-1450

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:

Vendor:

Description
The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.

The vulnerability exists due to the expectation of a certain file type during an upload. A remote authenticated attacker can execute arbitrary commands by injecting specially crafted command arguments.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Patch for this vulnerability id available through the Cisco Bug Search Tool.

Vulnerable software versions

: 2.6

---

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-wms4

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.