CVE-2016-2275

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://ics-cert.us-cert.gov/advisories/ICSA-16-049-01Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-16-049-01Third Party Advisory, US Government Resource

Timeline

Published: Feb 21, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-22776.3IAB.exe in Rockwell Automation Integrated Architecture Builder (IAB) before 9.6.0.8 and 9.7.x before 9.7.0.2 allows remote attackers to exec CVE-2016-22787.2Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticate CVE-2016-22796.1Cross-site scripting (XSS) vulnerability in the web server in Rockwell Automation Allen-Bradley CompactLogix 1769-L* before 28.011+ allows r CVE-2016-22807.5Buffer overflow in RDISERVER in Honeywell Uniformance Process History Database (PHD) R310, R320, and R321 allows remote attackers to cause a CVE-2016-22817.2Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current CVE-2016-22825.3Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configuration Utility before 3.18 do not properly encrypt credentials, which makes it eas CVE-2016-22835.3Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configuration Utility before 3.18 do not properly encrypt data, which makes it easier for CVE-2016-22858.8Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 dev CVE-2016-22867.5Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort CVE-2016-22876.1Cross-site scripting (XSS) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to inject arbitrary web script or CVE-2016-22887.8Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file.CVE-2016-22897.5Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently disc