CVE-2016-6435

Published: Oct 6, 2016Modified: May 6, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376.

Affected (1)

Products: Cisco: Secure Firewall Management Center

Cisco

1 product

Secure Firewall Management Center

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Secure Firewall Management Center	Version 6.0.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc2

Source: psirt@cisco.com

Vendor Advisory

http://www.securityfocus.com/bid/93421

Source: psirt@cisco.com

https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking

Source: psirt@cisco.com

https://www.exploit-db.com/exploits/40464/

Source: psirt@cisco.com

https://www.korelogic.com/Resources/Advisories/KL-001-2016-006.txt

Source: psirt@cisco.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc2