Medium severity · published Jul 8, 2016
CVE-2016-0252
IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecified vectors
5.1
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecified vectors.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Control Center · Ibm
6.0.0.0 · source: NVD
SC
Sterling Control Center · Ibm
5.4.0.0; 5.4.0.1; 5.4.1; 5.4.1.0; 5.4.2; 5.4.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0252
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0252
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21985641
More from Control Center
7.1
CVE-2017-1758
IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM…
6.5
CVE-2024-35113
IBM Control Center 6.2.1 and 6.3.1 could allow an authenticated user to obtain sensitive information exposed through a directory listing
5.4
CVE-2023-42007
IBM Sterling Control Center cross-site scripting
5.4
CVE-2021-20528
IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting
5.3
CVE-2023-43052
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input