CVE-2016-6468

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases: 11.5(1.10000.4). Known Fixed Releases: 12.0(0.98000.14).

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	Cisco Emergency Responder	Cisco Emergency Responder

References

http://www.securityfocus.com/bid/94786Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037428Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-cerVendor Advisory
http://www.securityfocus.com/bid/94786Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037428Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-cerVendor Advisory

Timeline

Published: Dec 14, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-64697.5A vulnerability in HTTP URL parsing of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker CVE-2016-64707.8A vulnerability in the installation procedure of the Cisco Hybrid Media Service could allow an authenticated, local attacker to elevate priv CVE-2016-64716.5A vulnerability in the web-based management interface of Cisco Firepower Management Center running FireSIGHT System software could allow an CVE-2016-64726.1A vulnerability in several parameters of the ccmivr page of Cisco Unified Communication Manager (CallManager) could allow an unauthenticated CVE-2016-64736.5A vulnerability in Cisco IOS on Catalyst Switches and Nexus 9300 Series Switches could allow an unauthenticated, adjacent attacker to cause CVE-2016-64747.3A vulnerability in the implementation of X.509 Version 3 for SSH authentication functionality in Cisco IOS and IOS XE Software could allow a CVE-2016-64805.1Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause CVE-2016-64838.6The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.CVE-2016-64846.1CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and CVE-2016-64857.5The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initi CVE-2016-64867.8Siemens SINEMA Server uses weak permissions for the application folder, which allows local users to gain privileges via unspecified vectors.CVE-2016-64897.5The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.