CVE-2013-1196

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime Network Control System, Prime LAN Management Solution (LMS), Prime Collaboration, Unified Provisioning Manager, Network Services Manager, Prime Data Center Network Manager (DCNM), and Quad does not properly validate input, which allows local users to obtain root privileges via unspecified vectors, aka Bug IDs CSCug29384, CSCug13866, CSCug29400, CSCug29406, CSCug29411, CSCug29413, CSCug29416, CSCug29418, CSCug29422, CSCug29425, and CSCug29426, a different issue than CVE-2013-1125.

La interfaz de línea de comandos en el sistema Cisco Secure Access Control (ACS), Servicios de Identidad del motor de software, Agente de Directorio Contexto, Gerente de Redes de Aplicaciones (ANM), Sistema de Control de Red Prime, LAN Management Solution Prime (LMS), Prime Collaboration, Provisioning Manager Unificado , Network Services Manager, el primer Data Center Network Manager (DCNM) y Quad no validan correctamente la entrada, lo que permite a usuarios locales obtener privilegios de root a través de vectores no especificados. Vulnerabilidad también conocida como Bug ID CSCug29384, CSCug13866, CSCug29400, CSCug29406, CSCug29411, CSCug29413, CSCug29416 , CSCug29418, CSCug29422, CSCug29425 y CSCug29426. Se trata de una cuestión diferente que CVE-2013-1125.

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Local

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-01-11 CVE Reserved
2013-04-29 CVE Published
2024-09-16 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1196	2013-04-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Application Networking Manager Search vendor "Cisco" for product "Application Networking Manager"				-		-		Affected
Cisco Search vendor "Cisco"		Context Directory Agent Search vendor "Cisco" for product "Context Directory Agent"				-		-		Affected
Cisco Search vendor "Cisco"		Identity Services Engine Software Search vendor "Cisco" for product "Identity Services Engine Software"				-		-		Affected
Cisco Search vendor "Cisco"		Network Services Manager Search vendor "Cisco" for product "Network Services Manager"				-		-		Affected
Cisco Search vendor "Cisco"		Prime Collaboration Search vendor "Cisco" for product "Prime Collaboration"				-		-		Affected
Cisco Search vendor "Cisco"		Prime Data Center Network Manager Search vendor "Cisco" for product "Prime Data Center Network Manager"				-		-		Affected
Cisco Search vendor "Cisco"		Prime Lan Management Solution Search vendor "Cisco" for product "Prime Lan Management Solution"				-		-		Affected
Cisco Search vendor "Cisco"		Prime Network Control System Search vendor "Cisco" for product "Prime Network Control System"				-		-		Affected
Cisco Search vendor "Cisco"		Quad Search vendor "Cisco" for product "Quad"				-		-		Affected
Cisco Search vendor "Cisco"		Secure Access Control System Search vendor "Cisco" for product "Secure Access Control System"				-		-		Affected
Cisco Search vendor "Cisco"		Unified Provisioning Manager Search vendor "Cisco" for product "Unified Provisioning Manager"				-		-		Affected