CVE-2016-1470

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuz76230.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-spsVendor Advisory
http://www.securityfocus.com/bid/92709
http://www.securitytracker.com/id/1036722
http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdfExploit, Third Party Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-spsVendor Advisory
http://www.securityfocus.com/bid/92709
http://www.securitytracker.com/id/1036722
http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdfExploit, Third Party Advisory

Timeline

Published: Sep 2, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-14716.1Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.CVE-2016-14727.5The web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to cause a denia CVE-2016-14739.8Cisco Small Business 220 devices with firmware before 1.0.1.1 have a hardcoded SNMP community, which allows remote attackers to read or modi CVE-2016-14744.3Cisco Prime Infrastructure 2.2(2) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct c CVE-2016-14765.4Cross-site scripting (XSS) vulnerability on Cisco IP Phone 8800 devices with software 11.0 allows remote authenticated users to inject arbit CVE-2016-14776.5Cisco Connected Streaming Analytics 1.1.1 allows remote authenticated users to discover a notification service password by reading administr CVE-2016-14787.5Cisco IOS 15.5(3)S3, 15.6(1)S2, 15.6(2)S1, and 15.6(2)T1 does not properly dequeue invalid NTP packets, which allows remote attackers to cau CVE-2016-14797.5Cisco IP Phone 8800 devices with software 11.0(1) allow remote attackers to cause a denial of service (memory corruption) via a crafted HTTP CVE-2016-14807.5A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (E CVE-2016-14817.5A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthen CVE-2016-14828.1Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script CVE-2016-14837.5Cisco WebEx Meetings Server 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-v