CVE-2016-6412: Cisco IOS

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

The Cisco Application-hosting Framework (CAF) component in Cisco IOS 15.6(1)T1 and IOS XE, when the IOx feature set is enabled, allows man-in-the-middle attackers to trigger arbitrary downloads via crafted HTTP headers, aka Bug ID CSCuz84773.

Affected products

• Cisco IOS: version 15.6(1)t1 only

Published 2016-09-24. Last modified 2026-06-17.