CVE-2016-1366

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-03-24 · updated 2026-06-17
Weakness: CWE-264

Description

The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows remote authenticated users to cause a denial of service (overwrite) via unspecified vectors, aka Bug ID CSCuw75848.

Affected products

Cisco IOS XR Software: 5.0.0, 5.0.1, 5.2.1, 5.2.3, 5.2.4, 5.2.5

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-ncs
http://www.securitytracker.com/id/1035407
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-ncs
http://www.securitytracker.com/id/1035407

Get alerted when CVE-2016-1366 or the next vulnerability affects your stack