Lucene search

[email protected]CVE-2016-2396

HistoryFeb 17, 2016 - 3:59 p.m.

CVE-2016-2396

2016-02-1715:59:00

CWE-77

[email protected]

web.nvd.nist.gov

cve-2016-2396

gms viewpoint

dell sonicwall

gms

analyzer

uma em5000

remote execution

command execution

security vulnerability

configuration input

nvd

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.022 Low

EPSS

Percentile

89.5%

JSON

The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.

CPENameOperatorVersion
sonicwall:analyzersonicwall analyzereq7.2
sonicwall:analyzersonicwall analyzereq8.0
sonicwall:analyzersonicwall analyzereq8.1
sonicwall:global_management_systemsonicwall global management systemeq7.2
sonicwall:global_management_systemsonicwall global management systemeq8.0
sonicwall:global_management_systemsonicwall global management systemeq8.1
sonicwall:uma_em5000_firmwaresonicwall uma em5000 firmwareeq7.2
sonicwall:uma_em5000_firmwaresonicwall uma em5000 firmwareeq8.0
sonicwall:uma_em5000_firmwaresonicwall uma em5000 firmwareeq8.1

CPE	Name	Operator	Version
sonicwall:analyzer	sonicwall analyzer	eq	7.2
sonicwall:analyzer	sonicwall analyzer	eq	8.0
sonicwall:analyzer	sonicwall analyzer	eq	8.1
sonicwall:global_management_system	sonicwall global management system	eq	7.2
sonicwall:global_management_system	sonicwall global management system	eq	8.0
sonicwall:global_management_system	sonicwall global management system	eq	8.1
sonicwall:uma_em5000_firmware	sonicwall uma em5000 firmware	eq	7.2
sonicwall:uma_em5000_firmware	sonicwall uma em5000 firmware	eq	8.0
sonicwall:uma_em5000_firmware	sonicwall uma em5000 firmware	eq	8.1

References

www.securitytracker.com/id/1035015

www.zerodayinitiative.com/advisories/ZDI-16-164

support.software.dell.com/product-notification/185943

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.022 Low

EPSS

Percentile

89.5%

JSON

Related for CVE-2016-2396

prion1 zdi1 cvelist1