VIR Vulnerability Intelligence Relay

CVE-2016-6443

high
Published 2016-10-27 · Modified 2026-05-06
CVSS v3
8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2
6.5
VIR risk
8.8

Description

A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability. More Information: CSCva27038, CSCva28335. Known Affected Releases: 3.1(0.128), 1.2(400), 2.0(1.0.34A).

Predictions

Exploit likelihood
92%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@cisco.com — https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-prime

Application impact
VendorProductVersionsFixed
ciscoevolved_programmable_network_manager1.2
ciscoevolved_programmable_network_manager2.0
ciscoprime_infrastructure1.2
ciscoprime_infrastructure1.2.0.103
ciscoprime_infrastructure1.2.1
ciscoprime_infrastructure1.3
ciscoprime_infrastructure1.3.0.20
ciscoprime_infrastructure1.4
ciscoprime_infrastructure1.4.0.45
ciscoprime_infrastructure1.4.1
ciscoprime_infrastructure1.4.2
ciscoprime_infrastructure2.0
ciscoprime_infrastructure2.1.0
ciscoprime_infrastructure2.2
ciscoprime_infrastructure2.2\(2\)
ciscoprime_infrastructure3.0
ciscoprime_infrastructure3.1
ciscoprime_infrastructure3.1.1

References

CWEs

CWE-89

Verify integrity in audit chain (admin only). AS-IS.