CVE-2016-9357
Last modified
CVE-2016-9357 is a vulnerability of currently unknown severity. An issue was discovered in certain legacy Eaton ePDUs -- the affected products are past end-of-life (EoL) and no longer supported: EAMxxx prior to June 30, 2015, EMAxxx prior to January 31, 2014, EAMAxx prior to January 31, 2014, EMAAxx prior to January 31, 2014, and ESWAxx prior to January 31, 2014. An unauthenticated attacker may be able to access configuration files with a specially crafted URL (Path Traversal).. EPSS estimates a 1.88% chance of exploitation in the next 30 days.
Description
An issue was discovered in certain legacy Eaton ePDUs -- the affected products are past end-of-life (EoL) and no longer supported: EAMxxx prior to June 30, 2015, EMAxxx prior to January 31, 2014, EAMAxx prior to January 31, 2014, EMAAxx prior to January 31, 2014, and ESWAxx prior to January 31, 2014. An unauthenticated attacker may be able to access configuration files with a specially crafted URL (Path Traversal).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Eaton | Eamxxx Series Epdu Firmware | <= 06-30-2015 |
| Eaton | Emaxxx Series Epdu Firmware | <= 01-31-2014 |
| Eaton | Eamaxx Series Epdu Firmware | <= 01-31-2014 |
| Eaton | Emaaxx Series Epdu Firmware | <= 01-31-2014 |
| Eaton | Eswaxx Series Epdu Firmware | <= 01-31-2014 |
References
- http://www.securityfocus.com/bid/95817Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-026-01Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/95817Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-026-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-9357?
How severe is CVE-2016-9357?
How do I fix CVE-2016-9357?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-9351An issue was discovered in Advantech SUISAccess Server Versi…
- CVE-2016-9352Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2016-9353An issue was discovered in Advantech SUISAccess Server Versi…
- CVE-2016-9354An issue was discovered in Moxa DACenter Versions 1.4 and ol…
- CVE-2016-9355An issue was discovered in Becton, Dickinson and Company (BD…
- CVE-2016-9356An issue was discovered in Moxa DACenter Versions 1.4 and ol…
- CVE-2016-9358A Hard-Coded Passwords issue was discovered in Marel Food Pr…
- CVE-2016-9359Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2016-9360An issue was discovered in General Electric (GE) Proficy HMI…6.7
- CVE-2016-9361An issue was discovered in Moxa NPort 5110 versions prior to…9.8
- CVE-2016-9362An issue was discovered in WAGO 750-8202/PFC200 prior to FW0…
- CVE-2016-9363An issue was discovered in Moxa NPort 5110 versions prior to…7.3
Are you affected by CVE-2016-9357?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST