CVE-2016-1406

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-05-25 · updated 2026-06-17
Weakness: CWE-284

Description

The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.

Affected products

Cisco Evolved Programmable Network Manager (EPNM): 1.2.0, 1.2.1.3, 1.2.200, 1.2.300
Cisco Prime Infrastructure: 1.2, 1.2.0.103, 1.2.1, 1.3, 1.3.0.20, 1.4 (+8)

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnm
http://www.securitytracker.com/id/1035948
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnm
http://www.securitytracker.com/id/1035948

Get alerted when CVE-2016-1406 or the next vulnerability affects your stack