PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9222 Cisco CVE debrief

CVE-2016-9222 is a medium-severity cross-site scripting issue in the web-based management interface of Cisco NetFlow Generation Appliance. An unauthenticated remote attacker could trigger XSS against a user of the interface on affected release 1.0(2). Cisco and NVD both list this as a CWE-79 issue, and the NVD vector requires user interaction.

Vendor
Cisco
Product
CVE-2016-9222
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-26
Original CVE updated
2026-05-13
Advisory published
2017-01-26
Advisory updated
2026-05-13

Who should care

Organizations running Cisco NetFlow Generation Appliance, especially administrators responsible for the web-based management interface and any security teams monitoring browser-facing admin portals.

Technical summary

The vulnerability affects Cisco NetFlow Generation Appliance release 1.0(2) and is described as an unauthenticated remote XSS condition in the web-based management interface. NVD classifies it as CWE-79 and rates it CVSS 6.1 with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network reachability, no privileges required, and user interaction needed.

Defensive priority

Medium. Treat as important for any exposed management interface, but the provided data does not indicate KEV listing or known ransomware use.

Recommended defensive actions

  • Confirm whether Cisco NetFlow Generation Appliance release 1.0(2) is deployed anywhere in the environment.
  • Follow Cisco's advisory guidance for remediation or upgrade for this product and version.
  • Limit access to the web-based management interface to trusted administrative networks only.
  • Review administrative workflows that rely on browser-based access and reduce unnecessary exposure of the interface.
  • Use least-privilege access for administrators and keep browser-side hardening and session protections in place for management users.

Evidence notes

The CVE record and NVD entry both identify Cisco NetFlow Generation Appliance 1.0(2) as affected. NVD classifies the weakness as CWE-79 and provides the CVSS v3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The source corpus includes Cisco's vendor advisory reference and the NVD record; the CVE was published on 2017-01-26 and last modified on 2026-05-13 in the supplied data.

Official resources

Use the CVE published date in the supplied data, 2017-01-26, for public tracking. The source corpus also references Cisco's vendor advisory for this issue.