PT-2017-8990 · Opmantek · Nmis

Matthew Kienow · Published 2017-04-10 · Updated 2017-04-14 · CVE-2016-6534

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opmantek NMIS versions prior to 4.3.7c Opmantek NMIS versions prior to 8.5.12G in non-default configurations

Description The issue concerns command injection via certain commands in the tools.pl CGI script. The affected commands include man, finger, ping, trace, and nslookup.

Recommendations For versions prior to 4.3.7c, update to version 4.3.7c or later. For versions prior to 8.5.12G in non-default configurations, update to version 8.5.12G or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2016-6534

Affected Products

Nmis

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-6534 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6534 · Vendor Advisory
• https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2 · Note