High severity · published Apr 10, 2017
CVE-2016-6534
Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affected in non-default configurations.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NM
Network Management Information System · Opmantek
through 4.3.6f; through 8.5.10g · source: NVD
Affected product
NM
Network Management Information System
Opmantek
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6534
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6534
Third Party Advisory
https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
More from Network Management Information System
5.4
CVE-2016-5642
Opmantek NMIS before 8.5.12G has XSS via SNMP