CVE-2016-2364

The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.

• CWE-310

• http://www.kb.cert.org/vuls/id/754056Third Party Advisory, US Government Resource
• http://www.kb.cert.org/vuls/id/754056Third Party Advisory, US Government Resource

Published

Jun 20, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2357Milesight IP security cameras through 2016-11-14 have a hard…9.8
• CVE-2016-2358Milesight IP security cameras through 2016-11-14 have a defa…9.8
• CVE-2016-2359Milesight IP security cameras through 2016-11-14 allow remot…9.8
• CVE-2016-2360Milesight IP security cameras through 2016-11-14 have a defa…9.8
• CVE-2016-2362Fonality (previously trixbox Pro) 12.6 through 14.1i before …
• CVE-2016-2363Fonality (previously trixbox Pro) 12.6 through 14.1i before …
• CVE-2016-2365A denial of service vulnerability exists in the handling of …
• CVE-2016-2366A denial of service vulnerability exists in the handling of …
• CVE-2016-2367An information leak exists in the handling of the MXIT proto…
• CVE-2016-2368Multiple memory corruption vulnerabilities exist in the hand…
• CVE-2016-2369A NULL pointer dereference vulnerability exists in the handl…
• CVE-2016-2370A denial of service vulnerability exists in the handling of …