CVE-2016-5053

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	OSRAM SYLVANIA Osram Lightify Home before 2016-07-26	OSRAM SYLVANIA Osram Lightify Home before 2016-07-26

References

https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059Exploit, Mitigation, Technical Description, Third Party Advisory
https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059Exploit, Mitigation, Technical Description, Third Party Advisory

Timeline

Published: Apr 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-50547.5OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.CVE-2016-50556.1OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.CVE-2016-50567.5OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.CVE-2016-50577.5OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.CVE-2016-50587.5OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.CVE-2016-50596.5OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/v CVE-2016-50606.1Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via CVE-2016-50616.1Multiple cross-site scripting (XSS) vulnerabilities in the web server in Aternity before 9.0.1 allow remote attackers to inject arbitrary we CVE-2016-50629.8The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote att CVE-2016-50635.3The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass auth CVE-2016-50659.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.CVE-2016-50669.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.