CVE-2016-1356

LOW

Cisco FireSIGHT System Software 6.1.0 - Info Disclosure

Title source: llm

Description

Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by measuring timing differences, aka Bug ID CSCuy41615.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory x_refsource_cisco

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-FireSIGHT1

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1035189

Scores

CVSS v3 3.7

EPSS 0.0083

EPSS Percentile 53.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-255 CWE-287

Status published

Products (1)

cisco/firesight_system_software _6.1.0

Published Mar 03, 2016

Tracked Since Feb 18, 2026