CVE-2016-2309

iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.

• CWE-345

• https://ics-cert.us-cert.gov/advisories/ICSA-16-138-01Third Party Advisory, US Government Resource
• https://ics-cert.us-cert.gov/advisories/ICSA-16-138-01Third Party Advisory, US Government Resource

Published

May 30, 2016

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2303CRLF injection vulnerability in Ecava IntegraXor before 5.0 …
• CVE-2016-2304Ecava IntegraXor before 5.0 build 4522 does not include the …
• CVE-2016-2305Cross-site scripting (XSS) vulnerability in Ecava IntegraXor…
• CVE-2016-2306The HMI web server in Ecava IntegraXor before 5.0 build 4522…
• CVE-2016-2307American Auto-Matrix Aspect-Nexus Building Automation Front-…
• CVE-2016-2308American Auto-Matrix Aspect-Nexus Building Automation Front-…
• CVE-2016-2310General Electric (GE) Multilink ML800, ML1200, ML1600, and M…9.8
• CVE-2016-2311Black Box AlertWerks ServSensor with firmware before SP473, …
• CVE-2016-2312Turning all screens off in Plasma-workspace and kscreenlocke…
• CVE-2016-2313auth_login.php in Cacti before 0.8.8g allows remote authenti…
• CVE-2016-2314GlobespanVirata ftpd 1.0, as used on Huawei SmartAX MT882 de…
• CVE-2016-2315revision.c in git before 2.7.4 uses an incorrect integer dat…9.8