CVE-2016-2397

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securitytracker.com/id/1035015Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-163Third Party Advisory
https://support.software.dell.com/product-notification/185943Vendor Advisory
http://www.securitytracker.com/id/1035015Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-163Third Party Advisory
https://support.software.dell.com/product-notification/185943Vendor Advisory

Timeline

Published: Feb 17, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-23986.5Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to d CVE-2016-23997.8Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of servic CVE-2016-24025.9OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain wit CVE-2016-24039.8Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid us CVE-2016-24047.5Huawei switches S5700, S6700, S7700, S9700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R005C00SPC500, V200R00 CVE-2016-24058.8Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of servi CVE-2016-24064.3The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to CVE-2016-24087.8Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow restricted users to gain privi CVE-2016-24098.1A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application CVE-2016-24107.4A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages CVE-2016-24116.5A Qualcomm Power Management kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application tha CVE-2016-24127.8include/core/SkPostConfig.h in Skia, as used in System_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x b