CVE-2016-0859

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted RPC request.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.zerodayinitiative.com/advisories/ZDI-16-104
https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01Third Party Advisory, US Government Resource
http://www.zerodayinitiative.com/advisories/ZDI-16-104
https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01Third Party Advisory, US Government Resource

Timeline

Published: Jan 15, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-08607.5Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a craft CVE-2016-08618.8General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute CVE-2016-08626.5General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain CVE-2016-08638.8Cross-site request forgery (CSRF) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, an CVE-2016-08645.3Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain CVE-2016-08658.8Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote authenticated users CVE-2016-08666.1Cross-site scripting (XSS) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 CVE-2016-08677.5CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.CVE-2016-08689.8Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote CVE-2016-08695.0Heap-based buffer overflow in MICROSYS PROMOTIC before 8.3.11 allows remote authenticated users to cause a denial of service via a malformed CVE-2016-08705.3The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request.CVE-2016-08717.5Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentia