CVE-2016-6537

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings.

• CWE-200

• http://www.kb.cert.org/vuls/id/667480Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/92936
• http://www.kb.cert.org/vuls/id/667480Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/92936

Published

Sep 19, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6530Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier ha…
• CVE-2016-6531Open Dental 16.1 and earlier has a hardcoded MySQL root pass…9.8
• CVE-2016-6532DEXIS Imaging Suite 10 has a hardcoded password for the sa a…
• CVE-2016-6534Opmantek NMIS before 4.3.7c has command injection via man, f…
• CVE-2016-6535AVer Information EH6108H+ devices with firmware X9.03.24.00.…
• CVE-2016-6536The /setup URI on AVer Information EH6108H+ devices with fir…
• CVE-2016-6538The TrackR Bravo mobile app stores the account password used…
• CVE-2016-6539The Trackr device ID is constructed of a manufacturer identi…
• CVE-2016-6540Unauthenticated access to the cloud-based service maintained…
• CVE-2016-6541TrackR Bravo device allows unauthenticated pairing, which en…
• CVE-2016-6542The iTrack device tracking ID number, also called "LosserID"…
• CVE-2016-6543A captured MAC/device ID of an iTrack Easy can be registered…