CVE-2016-6434

HIGH

Cisco Firepower Management Center 6.0.1 - Info Disclosure

Title source: llm

Description

Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive information by leveraging CLI access, aka Bug ID CSCva30370.

Exploits (1)

exploitdb WRITEUP

by KoreLogic · textlocallinux

https://www.exploit-db.com/exploits/40465

View Code ZIP pw:eip

References (5)

[Vendor Advisory] http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc1

[Various Sources] https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking

[Various Sources] https://www.korelogic.com/Resources/Advisories/KL-001-2016-005.txt

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/93412

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/40465/

Scores

CVSS v3 7.8

EPSS 0.0039

EPSS Percentile 59.3%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-287

Status draft

Affected Products (1)

cisco/secure_firewall_management_center

Timeline

Published Oct 06, 2016

Tracked Since Feb 18, 2026