Strix
26.1K

CVE-2016-1321

UnknownEPSS 0.92%

Last modified

CVE-2016-1321 is a vulnerability of currently unknown severity. Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco server, aka Bug ID CSCut98082.. EPSS estimates a 0.92% chance of exploitation in the next 30 days.

Description

Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco server, aka Bug ID CSCut98082.

Metrics

EPSS Probability
0.92%

55.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoUniversal Small Cell Firmwarer2.12_base
CiscoUniversal Small Cell Firmwarer2.13_base
CiscoUniversal Small Cell Firmwarer2.14_base
CiscoUniversal Small Cell Firmwarer2.15_base
CiscoUniversal Small Cell Firmwarer2.16_base
CiscoUniversal Small Cell Firmwarer2.17_base
CiscoUniversal Small Cell Firmwarer3.2_base
CiscoUniversal Small Cell Firmwarer3.3_base
CiscoUniversal Small Cell Firmwarer3.4_1.1
CiscoUniversal Small Cell Firmwarer3.4_2.1
CiscoUniversal Small Cell Firmwarer3.4_2.17
CiscoUniversal Small Cell Firmwarer3.4_base
CiscoUniversal Small Cell Firmwarer3.5_base

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2016-1321?
Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco server, aka Bug ID CSCut98082.
How severe is CVE-2016-1321?
Severity scoring for CVE-2016-1321 is pending analysis. The EPSS model estimates a 0.92% probability of exploitation in the next 30 days.
How do I fix CVE-2016-1321?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-1321?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST