CVE-2016-1349 : The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 through 3.7 allows remote attac

The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 through 3.7 allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in a Smart Install packet, aka Bug ID CSCuv45410.

Published 2016-03-26 01:59:03

Updated 2016-12-03 03:20:33

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2016-1349

EPSS FAQ

0.29%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-1349

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2016-1349

http://www.securitytracker.com/id/1035385

Cisco IOS/IOS XE Smart Install Client Bug Lets Remote Users Cause the Target Device to Reload - SecurityTracker
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-smi

Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability
Vendor Advisory

Products affected by CVE-2016-1349

SUN » Opensolaris » Version: Snv 124 Sparc Edition
cpe:2.3:o:sun:opensolaris:snv_124:*:sparc:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.6e 3.6.2e
cpe:2.3:o:cisco:ios_xe:3.6e_3.6.2e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.7e 3.7.0e
cpe:2.3:o:cisco:ios_xe:3.7e_3.7.0e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.5e 3.5.1e
cpe:2.3:o:cisco:ios_xe:3.5e_3.5.1e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.4sg 3.4.5sg
cpe:2.3:o:cisco:ios_xe:3.4sg_3.4.5sg:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.4sg 3.4.2sg
cpe:2.3:o:cisco:ios_xe:3.4sg_3.4.2sg:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.4sg 3.4.4sg
cpe:2.3:o:cisco:ios_xe:3.4sg_3.4.4sg:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.4sg 3.4.3sg
cpe:2.3:o:cisco:ios_xe:3.4sg_3.4.3sg:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.4sg 3.4.0sg
cpe:2.3:o:cisco:ios_xe:3.4sg_3.4.0sg:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.6e 3.6.2ae
cpe:2.3:o:cisco:ios_xe:3.6e_3.6.2ae:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.4sg 3.4.6sg
cpe:2.3:o:cisco:ios_xe:3.4sg_3.4.6sg:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.5e 3.5.3e
cpe:2.3:o:cisco:ios_xe:3.5e_3.5.3e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.5e 3.5.2e
cpe:2.3:o:cisco:ios_xe:3.5e_3.5.2e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.5e 3.5.0e
cpe:2.3:o:cisco:ios_xe:3.5e_3.5.0e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.4sg 3.4.1sg
cpe:2.3:o:cisco:ios_xe:3.4sg_3.4.1sg:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.7e 3.7.2e
cpe:2.3:o:cisco:ios_xe:3.7e_3.7.2e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.7e 3.7.1e
cpe:2.3:o:cisco:ios_xe:3.7e_3.7.1e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.6e 3.6.1e
cpe:2.3:o:cisco:ios_xe:3.6e_3.6.1e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.6e 3.6.0e
cpe:2.3:o:cisco:ios_xe:3.6e_3.6.0e:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3xo 3.3.2xo
cpe:2.3:o:cisco:ios_xe:3.3xo_3.3.2xo:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3xo 3.3.1xo
cpe:2.3:o:cisco:ios_xe:3.3xo_3.3.1xo:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3xo 3.3.0xo
cpe:2.3:o:cisco:ios_xe:3.3xo_3.3.0xo:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3se 3.3.3se
cpe:2.3:o:cisco:ios_xe:3.3se_3.3.3se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3se 3.3.2se
cpe:2.3:o:cisco:ios_xe:3.3se_3.3.2se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.2se 3.2.1se
cpe:2.3:o:cisco:ios_xe:3.2se_3.2.1se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3se 3.3.5se
cpe:2.3:o:cisco:ios_xe:3.3se_3.3.5se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3se 3.3.4se
cpe:2.3:o:cisco:ios_xe:3.3se_3.3.4se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3se 3.3.1se
cpe:2.3:o:cisco:ios_xe:3.3se_3.3.1se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.3se 3.3.0se
cpe:2.3:o:cisco:ios_xe:3.3se_3.3.0se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.2se 3.2.0se
cpe:2.3:o:cisco:ios_xe:3.2se_3.2.0se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.2ja 3.2.0ja
cpe:2.3:o:cisco:ios_xe:3.2ja_3.2.0ja:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.2se 3.2.3se
cpe:2.3:o:cisco:ios_xe:3.2se_3.2.3se:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe » Version: 3.2se 3.2.2se
cpe:2.3:o:cisco:ios_xe:3.2se_3.2.2se:*:*:*:*:*:*:*
Matching versions
Intel » Core I5-9400f Firmware » Version: N/A
cpe:2.3:o:intel:core_i5-9400f_firmware:-:*:*:*:*:*:*:*
Matching versions
Samsung » X14j Firmware » Version: T-ms14jakucb-1102.5
cpe:2.3:o:samsung:x14j_firmware:t-ms14jakucb-1102.5:*:*:*:*:*:*:*
Matching versions
Netgear » Jr6150 Firmware
Versions before (<) 2017-01-06
cpe:2.3:o:netgear:jr6150_firmware:*:*:*:*:*:*:*:*
Matching versions
Zyxel » Gs1900-10hp Firmware
Versions before (<) 2.50\(aazi.0\)c0
cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*
Matching versions
Zzinc » Keymouse Firmware » Version: 3.08 For Windows
cpe:2.3:o:zzinc:keymouse_firmware:3.08:*:*:*:*:windows:*:*
Matching versions

Vulnerability Details : CVE-2016-1349

Exploit prediction scoring system (EPSS) score for CVE-2016-1349

CVSS scores for CVE-2016-1349

CWE ids for CVE-2016-1349

References for CVE-2016-1349

Products affected by CVE-2016-1349