A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access…

published 2016-11-19 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7373

cvss: 2.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. This vulnerability affects the following products if they are running a vulnerable release of Cisco IOS XE Software: Cisco 5700 Series Wireless LAN Controllers, Cisco Catalyst 3650 Series Switches, Cisco Catalyst 3850 Series Switches, Cisco Catalyst 4500E Series Switches, Cisco Catalyst 4500X Series Switches. More Information: CSCva60013 CSCvb22622. Known Affected Releases: 3.7(0) 16.4.1 Denali-16.1.3 Denali-16.2.2 Denali-16.3.1. Known Fixed Releases: 15.2(4)E3 16.1(2.208) 16.2(2.42) 16.3(1.22) 16.4(0.190) 16.5(0.29).

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	2.5	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD	2.0	1.9	AV:L/AC:M/Au:N/C:N/I:P/A:N

Affected products

n/a Cisco IOS XE 3.7(0) through Denali-16.3.1

Classification

Weakness

CWE-20 Improper Input Validation

Technology feeds

Cisco IOS rss critical rss

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20161115-iosxe
vendor-advisory
securityfocus.com /bid/94340
vdb-entry
securitytracker.com /id/1037299
vdb-entry

Sources

CVE List CVE-2016-6450
NVD CVE-2016-6450

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary