Exploitation Summary
EIP tracks 3 public exploits for CVE-2016-6433.
PoCs published by Metasploit, KoreLogic, Matt, sinn3r, including Metasploit module exploits/linux/http/cisco_firepower_useradd.
AI-analyzed exploit summary This Metasploit module exploits CVE-2016-6433, a post-authentication vulnerability in Cisco Firepower Management Console 6.0.1, allowing the creation of a backdoor SSH account via improper useradd binary execution. It authenticates, creates a malicious user, and leverages SSH for command execution.
Description
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.
Exploits (3)
This Metasploit module exploits CVE-2016-6433, a post-authentication vulnerability in Cisco Firepower Management Console 6.0.1, allowing the creation of a backdoor SSH account via improper useradd binary execution. It authenticates, creates a malicious user, and leverages SSH for command execution.
This exploit demonstrates an authenticated remote command execution vulnerability in Cisco Firepower Threat Management Console. It leverages an unrestricted file upload to execute arbitrary commands as the www user, which can then escalate to root via sudo privileges.
This Metasploit module exploits a post-authentication vulnerability in Cisco Firepower Management Console 6.0.1 to create a backdoor SSH account via the useradd binary. It leverages a configuration flaw allowing the www user to execute arbitrary commands.
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H