CVE-2016-2397

CRITICAL

Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 - Remote Code Execution via XML Deserialization

Title source: llm
STIX 2.1

Description

The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-16-163
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1035015

Scores

CVSS v3 9.8
EPSS 0.0504
EPSS Percentile 89.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-77
Status published
Products (9)
sonicwall/analyzer 7.2
sonicwall/analyzer 8.0
sonicwall/analyzer 8.1
sonicwall/global_management_system 7.2
sonicwall/global_management_system 8.0
sonicwall/global_management_system 8.1
sonicwall/uma_em5000_firmware 7.2
sonicwall/uma_em5000_firmware 8.0
sonicwall/uma_em5000_firmware 8.1
Published Feb 17, 2016
Tracked Since Feb 18, 2026