CVE-2016-6534

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affected in non-default configurations.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	Opmantek NMIS before 8.5.12G	Opmantek NMIS before 8.5.12G

References

Timeline

Published: Apr 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-65359.8AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access CVE-2016-65369.8The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access res CVE-2016-65377.5AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentia CVE-2016-65388.8The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated app CVE-2016-65393.5The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address CVE-2016-65406.5Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr devi CVE-2016-65418.8TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attribut CVE-2016-65423.7The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The CVE-2016-65435.9A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allo CVE-2016-65447.5getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps. This vulnerability CVE-2016-65459.8Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS usi CVE-2016-65467.8The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file