What is the CVSS score of CVE-2016-6399?

CVE-2016-6399 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

Ace Application Control Engine Module A1 CVE-2016-6399

HIGH

Improper Input Validation (CWE-20)

2016-09-12 psirt@cisco.com

Cisco Denial Of Service Ace Application Control Engine Module A1 Ace Application Control Engine Module A3 Ace Application Control Engine Module A4 Ace Application Control Engine Module A5 Ace 4700 Series Application Control Engine Appliance Ace 4700 Series Application Control Engine Appliance A1 Ace 4700 Series Application Control Engine Appliance A3 Ace 4700 Series Application Control Engine Appliance A4 Ace 4700 Series Application Control Engine Appliance A5

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Sep 12, 2016 - 10:59 cve.org

HIGH 7.5

DescriptionCVE.org

Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets, aka Bug ID CSCvb16317.

AnalysisAI

Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets, aka Bug ID CSCvb16317. Affected products include: Cisco Ace Application Control Engine Module A1, Cisco Ace Application Control Engine Module A3, Cisco Ace Application Control Engine Module A4, Cisco Ace Application Control Engine Module A5, Cisco Ace 4700 Series Application Control Engine Appliance.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.