CVE-2015-4186
The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The diagnostics subsystem in the administrative web interface on Cisco Virtualization Experience (aka VXC) Client 6215 devices with firmware 11.2(27.4) allows local users to gain privileges for OS command execution via a crafted option value, aka Bug ID CSCug54412.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.58% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- cisco/virtualization experience client 6000 series firmware
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/viewAlert.x?alertId=39347Vendor Advisory
- http://www.securityfocus.com/bid/75195
- http://www.securitytracker.com/id/1032583
- http://tools.cisco.com/security/center/viewAlert.x?alertId=39347Vendor Advisory
- http://www.securityfocus.com/bid/75195
- http://www.securitytracker.com/id/1032583
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.