CVE-2016-3213

HIGH

Microsoft Internet Explorer - Access Control

Title source: rule

Description

The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 9 through 11 has an improper fallback mechanism, which allows remote attackers to gain privileges via NetBIOS name responses, aka "WPAD Elevation of Privilege Vulnerability."

Exploits (1)

metasploit WORKING POC
by vvalien, hdm, tombkeeper · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/netbios_spoof_nat.rb

References (4)

Scores

CVSS v3 8.8
EPSS 0.7831
EPSS Percentile 99.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-264
Status published
Products (13)
microsoft/internet_explorer 9
microsoft/internet_explorer 10
microsoft/internet_explorer 11
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_7
microsoft/windows_8.1
microsoft/windows_rt_8.1
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1
... and 3 more
Published Jun 16, 2016
Tracked Since Feb 18, 2026