CVE-2016-2275

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code.

• CWE-284

• https://ics-cert.us-cert.gov/advisories/ICSA-16-049-01Third Party Advisory, US Government Resource
• https://ics-cert.us-cert.gov/advisories/ICSA-16-049-01Third Party Advisory, US Government Resource

Published

Feb 21, 2016

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2268Dell SecureWorks app before 2.1 for iOS does not validate SS…
• CVE-2016-2270Xen 4.6.x and earlier allows local guest administrators to c…
• CVE-2016-2271VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix C…
• CVE-2016-2272Eaton Lighting EG2 Web Control 4.04P and earlier allows remo…
• CVE-2016-2273Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-2274An issue was discovered in Adcon Telemetry A850 Telemetry Ga…
• CVE-2016-2276Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-2277IAB.exe in Rockwell Automation Integrated Architecture Build…
• CVE-2016-2278Schneider Electric Struxureware Building Operations Automati…
• CVE-2016-2279Cross-site scripting (XSS) vulnerability in the web server i…6.1
• CVE-2016-2280Buffer overflow in RDISERVER in Honeywell Uniformance Proces…
• CVE-2016-2281Untrusted search path vulnerability in ABB Panel Builder 800…