Summaryinfo

A vulnerability categorized as critical has been discovered in Cisco Prime Network Control System. This issue affects some unknown processing of the component CLI. The manipulation results in input validation. This vulnerability is reported as CVE-2013-1196. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco Prime Network Control System (affected version unknown). Affected is an unknown functionality of the component CLI. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, and integrity. CVE summarizes:

The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime Network Control System, Prime LAN Management Solution (LMS), Prime Collaboration, Unified Provisioning Manager, Network Services Manager, Prime Data Center Network Manager (DCNM), and Quad does not properly validate input, which allows local users to obtain root privileges via unspecified vectors, aka Bug IDs CSCug29384, CSCug13866, CSCug29400, CSCug29406, CSCug29411, CSCug29413, CSCug29416, CSCug29418, CSCug29422, CSCug29425, and CSCug29426, a different issue than CVE-2013-1125.

The weakness was disclosed 04/12/2013 with Cisco as CVE-2013-1196 as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability is traded as CVE-2013-1196 since 01/11/2013. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at tools.cisco.com. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at OSVDB (92826†). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Cisco

Name

• Prime Network Control System

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion