CVE-2016-6602

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Jan 23, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-66039.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTPCVE-2016-66049.8NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via uCVE-2016-66057.5Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.CVE-2016-66068.1An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attackCVE-2016-66076.1XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); CVE-2016-66086.1XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially cCVE-2016-66098.8An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array exporCVE-2016-66104.3A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to disCVE-2016-66118.1An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack throughCVE-2016-66126.5An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database CVE-2016-66135.3An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but theCVE-2016-66146.8An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the us
CVE-2016-6602: Critical severity, CVSS 9.8 | Vulnix