CVE-2016-6598

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a method that allows uploading a file to an arbitrary path on the machine that is running Track-It!. This can be used to upload a file to the web root and achieve code execution as NETWORK SERVICE or SYSTEM.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jan/92Exploit, Mailing List, Technical Description, Third Party Advisory
https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015Vendor Advisory
https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jan/92Exploit, Mailing List, Technical Description, Third Party Advisory
https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015Vendor Advisory
https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txtExploit, Third Party Advisory

Timeline

Published: Jan 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-65999.8BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This CVE-2016-66009.8Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to uploa CVE-2016-66017.5Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to rea CVE-2016-66029.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtai CVE-2016-66039.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP CVE-2016-66049.8NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via u CVE-2016-66057.5Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.CVE-2016-66068.1An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack CVE-2016-66076.1XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); CVE-2016-66086.1XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially c CVE-2016-66098.8An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array expor CVE-2016-66104.3A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to dis