CVE-2016-1297

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-02-26 · updated 2026-06-17
Weakness: CWE-78

Description

The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801.

Affected products

Cisco Application Control Engine Software: a5(1.0), a5(1.1), a5(1.2), a5(2.0), a5(2.1), a5(2.1e) (+1)

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-ace
http://www.securitytracker.com/id/1035104
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160224-ace
http://www.securitytracker.com/id/1035104

Get alerted when CVE-2016-1297 or the next vulnerability affects your stack