CVEvulnerability
CVE-2016-1335
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-02-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.1 HIGH — AV:N/AC:H/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previously used for an administrator's connection, aka Bug ID CSCux22492.
Affected configurations
• cisco asr 5000 series software 16.5.2
• cisco asr 5000 series software 17.7.0
• cisco asr 5000 series software 18.4.0
• cisco asr 5000 series software 19.0.1
• cisco asr 5000 series software 19.3.0
• cisco asr 5000 series software 20.0.0
Related
Weakness · not in database (1)
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160218-asr Vendor Advisory
- http://www.securitytracker.com/id/1035062 Third Party Advisory, VDB Entry
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160218-asr Vendor Advisory
- http://www.securitytracker.com/id/1035062 Third Party Advisory, VDB Entry