CVE-2016-1406: cisco evolved_programmable_network_manager Improper Access Control
Vulnerability summary
CVE-2016-1406 is a high (CVSS 8.8) Improper Access Control vulnerability in cisco evolved_programmable_network_manager. EPSS estimates a 1.62% chance of exploitation in the next 30 days, higher than 75.6% of scored vulnerabilities.
Timeline
- 25-05-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.62%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
0.00 pp
From 1.62% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco2 products
- evolved_programmable_network_manager1.2.0 | 1.2.1.3 | 1.2.200 | 1.2.300
- prime_infrastructure1.2 | 1.2.0.103 | 1.2.1 | 1.3 | 1.3.0.20 | 1.4 | 1.4.0.45 | 1.4.1 | 1.4.2 | 2.0 | 2.1.0 | 2.2 | 2.2\(2\) | 3.0
1 vendor · 2 products
References
2 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnmVendor AdvisoryX Refsource CISCO