CVE-2016-3213

HIGH

Internet Explorer 9-11 and Windows - Privilege Escalation via WPAD NetBIOS Name Response

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-3213. PoCs published by vvalien, hdm, tombkeeper, including Metasploit module auxiliary/server/netbios_spoof_nat.

AI-analyzed exploit summary This Metasploit module exploits CVE-2016-3213 by spoofing NetBIOS responses to poison the cache of a target system, forcing it to resolve a specified hostname (e.g., WPAD) to an attacker-controlled IP. It brute-forces transaction IDs to bypass NAT gateways and maintain persistent spoofing.

Description

The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 9 through 11 has an improper fallback mechanism, which allows remote attackers to gain privileges via NetBIOS name responses, aka "WPAD Elevation of Privilege Vulnerability."

Exploits (1)

metasploit WORKING POC
by vvalien, hdm, tombkeeper · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/netbios_spoof_nat.rb

This Metasploit module exploits CVE-2016-3213 by spoofing NetBIOS responses to poison the cache of a target system, forcing it to resolve a specified hostname (e.g., WPAD) to an attacker-controlled IP. It brute-forces transaction IDs to bypass NAT gateways and maintain persistent spoofing.

Classification
Working Poc 100%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows (NetBIOS Name Service)
No auth needed
Prerequisites: Network access to the target · Ability to intercept or trigger NetBIOS name resolution requests
devstral-2 · analyzed Mar 05, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036096
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036104

Scores

CVSS v3 8.8
EPSS 0.7831
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-264
Status published
Products (13)
microsoft/internet_explorer 9
microsoft/internet_explorer 10
microsoft/internet_explorer 11
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_7
microsoft/windows_8.1
microsoft/windows_rt_8.1
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1
... and 3 more
Published Jun 16, 2016
Tracked Since Feb 18, 2026