Lucene search

ZdiCVE-2016-2396

HistoryFeb 17, 2016 - 3:59 p.m.

CVE-2016-2396

2016-02-1715:59:06

CWE-77

zdi

web.nvd.nist.gov

cve-2016-2396

gms viewpoint

dell sonicwall

gms

analyzer

uma em5000

remote execution

command execution

security vulnerability

configuration input

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.031

Percentile

91.3%

JSON

The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.

Affected configurations

Nvd

Node

sonicwallanalyzerMatch7.2

sonicwallanalyzerMatch8.0

sonicwallanalyzerMatch8.1

sonicwallglobal_management_systemMatch7.2

sonicwallglobal_management_systemMatch8.0

sonicwallglobal_management_systemMatch8.1

Node

sonicwalluma_em5000_firmwareMatch7.2

sonicwalluma_em5000_firmwareMatch8.0

sonicwalluma_em5000_firmwareMatch8.1

AND

sonicwalluma_em5000Match-

VendorProductVersionCPE
sonicwallanalyzer7.2cpe:2.3:a:sonicwall:analyzer:7.2:*:*:*:*:*:*:*
sonicwallanalyzer8.0cpe:2.3:a:sonicwall:analyzer:8.0:*:*:*:*:*:*:*
sonicwallanalyzer8.1cpe:2.3:a:sonicwall:analyzer:8.1:*:*:*:*:*:*:*
sonicwallglobal_management_system7.2cpe:2.3:a:sonicwall:global_management_system:7.2:*:*:*:*:*:*:*
sonicwallglobal_management_system8.0cpe:2.3:a:sonicwall:global_management_system:8.0:*:*:*:*:*:*:*
sonicwallglobal_management_system8.1cpe:2.3:a:sonicwall:global_management_system:8.1:*:*:*:*:*:*:*
sonicwalluma_em5000_firmware7.2cpe:2.3:o:sonicwall:uma_em5000_firmware:7.2:*:*:*:*:*:*:*
sonicwalluma_em5000_firmware8.0cpe:2.3:o:sonicwall:uma_em5000_firmware:8.0:*:*:*:*:*:*:*
sonicwalluma_em5000_firmware8.1cpe:2.3:o:sonicwall:uma_em5000_firmware:8.1:*:*:*:*:*:*:*
sonicwalluma_em5000-cpe:2.3:h:sonicwall:uma_em5000:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sonicwall	analyzer	7.2	cpe:2.3:a:sonicwall:analyzer:7.2:::::::*
sonicwall	analyzer	8.0	cpe:2.3:a:sonicwall:analyzer:8.0:::::::*
sonicwall	analyzer	8.1	cpe:2.3:a:sonicwall:analyzer:8.1:::::::*
sonicwall	global_management_system	7.2	cpe:2.3:a:sonicwall:global_management_system:7.2:::::::*
sonicwall	global_management_system	8.0	cpe:2.3:a:sonicwall:global_management_system:8.0:::::::*
sonicwall	global_management_system	8.1	cpe:2.3:a:sonicwall:global_management_system:8.1:::::::*
sonicwall	uma_em5000_firmware	7.2	cpe:2.3:o:sonicwall:uma_em5000_firmware:7.2:::::::*
sonicwall	uma_em5000_firmware	8.0	cpe:2.3:o:sonicwall:uma_em5000_firmware:8.0:::::::*
sonicwall	uma_em5000_firmware	8.1	cpe:2.3:o:sonicwall:uma_em5000_firmware:8.1:::::::*
sonicwall	uma_em5000	-	cpe:2.3:h:sonicwall:uma_em5000:-:::::::*

References

www.securitytracker.com/id/1035015

www.zerodayinitiative.com/advisories/ZDI-16-164

support.software.dell.com/product-notification/185943

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.031

Percentile

91.3%

JSON

Related for CVE-2016-2396