Improper authentication in Cisco IPICS 4.8 to 4.10
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Media Services (UMS) could allow an unauthenticated, remote attacker to modify configuration parameters of the UMS and cause the system to become unavailable. Affected Products: This vulnerability affects Cisco IPICS releases 4.8(1) to 4.10(1). More Information: CSCva46644. Known Affected Releases: 4.10(1) 4.8(1) 4.8(2) 4.9(1) 4.9(2).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco IPICS 4.8(1) to 4.10(1) | Cisco IPICS 4.8(1) to 4.10(1) | — | No fix listed | CNA |
- Cisco IPICS 4.8(1) to 4.10(1) Vendor— Affected Cisco IPICS 4.8(1) to 4.10(1) Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.8\(1\):*:*:*:*:*:*:* | 4.8(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.8\(2\):*:*:*:*:*:*:* | 4.8(2) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.9\(1\):*:*:*:*:*:*:* | 4.9(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.9\(2\):*:*:*:*:*:*:* | 4.9(2) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.10\(1\):*:*:*:*:*:*:* | 4.10(1) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.8\(1\):*:*:*:*:*:*:* Versions 4.8(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.8\(2\):*:*:*:*:*:*:* Versions 4.8(2) Vulnerable ·Cisco
- cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.9\(1\):*:*:*:*:*:*:* Versions 4.9(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.9\(2\):*:*:*:*:*:*:* Versions 4.9(2) Vulnerable ·Cisco
- cpe:2.3:a:cisco:ip_interoperability_and_collaboration_system:4.10\(1\):*:*:*:*:*:*:* Versions 4.10(1) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6397
- 2026-10-03 Alias added: GHSA-9fq7-3gmm-wjpp
References
More Cisco Ip Interoperability And Collaboration System vulnerabilities
- TI-2016-05512 Access control flaw in Cisco IP Interoperability and Collaboration System before 5.0 CVSS 3.0HIGH 7.8
- TI-2016-05511 Cross-site scripting in Cisco IP Interoperability and Collaboration System 4.10 CVSS 3.0MEDIUM 6.1
- TI-2016-01266 Cross-site scripting (XSS) vulnerability in Cisco IP Interoperability and Collaboration… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2016-6397 · CVE Program
- CVE-2016-6397 · NVD
- FIRST EPSS
- GHSA-9fq7-3gmm-wjpp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences