CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit.

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

55.71% chance of exploitation in the next 30 days, 99th percentile

Published

2017-01-23

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfus…
• pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt862★ · 2025-04-16

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40229

Security advisories

• http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_cred_disclosure
• http://www.securityfocus.com/bid/92402
• https://blogs.securiteam.com/index.php/archives/2712

References

• CVE Record
• NVD entry

Related

• CVE-2014-1201
• CVE-2014-1836
• CVE-2014-2921
• CVE-2014-2922
• CVE-2014-7862
• CVE-2016-6598