CVE-2016-6433

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/140467/Cisco-Firepower-Management-Console-6.0-Post-Authentication-UserAdd.htmlThird Party Advisory, VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmcVendor Advisory
http://www.securityfocus.com/bid/93414Third Party Advisory, VDB Entry
https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunkingThird Party Advisory
https://www.exploit-db.com/exploits/40463/Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/41041/Third Party Advisory, VDB Entry
https://www.korelogic.com/Resources/Advisories/KL-001-2016-007.txtThird Party Advisory
http://packetstormsecurity.com/files/140467/Cisco-Firepower-Management-Console-6.0-Post-Authentication-UserAdd.htmlThird Party Advisory, VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmcVendor Advisory
http://www.securityfocus.com/bid/93414Third Party Advisory, VDB Entry
https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunkingThird Party Advisory
https://www.exploit-db.com/exploits/40463/Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/41041/Third Party Advisory, VDB Entry
https://www.korelogic.com/Resources/Advisories/KL-001-2016-007.txtThird Party Advisory

Timeline

Published: Oct 6, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-64347.8Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive information by leve CVE-2016-64356.5The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters,CVE-2016-64366.1Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 through 3.1.14018 in the Cisco Host Scan package, as used in ASA Web V CVE-2016-64375.9A vulnerability in the SSL session cache management of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote at CVE-2016-64385.9A vulnerability in Cisco IOS XE Software running on Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker CVE-2016-64397.5A vulnerability in the detection engine reassembly of HTTP packets for Cisco Firepower System Software before 6.0.1 could allow an unauthent CVE-2016-64406.5The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in CVE-2016-64419.8A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to CVE-2016-64428.8A vulnerability in Cisco Finesse Agent and Supervisor Desktop Software could allow an unauthenticated, remote attacker to conduct a cross-si CVE-2016-64438.8A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticat CVE-2016-64448.8A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attac CVE-2016-64459.1A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Se