CVE-2016-9796

Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\SYSTEM on the server. NOTE: The discoverer states "The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server."

• CWE-264
• CWE-287

• http://blog.malerisch.net/2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.htmlExploit, Third Party Advisory
• http://www.securityfocus.com/bid/94649
• https://github.com/malerisch/omnivista-8770-unauth-rceThird Party Advisory
• https://www.exploit-db.com/exploits/40862/
• https://www.youtube.com/watch?v=aq37lQKa9skExploit
• http://blog.malerisch.net/2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.htmlExploit, Third Party Advisory
• http://www.securityfocus.com/bid/94649
• https://github.com/malerisch/omnivista-8770-unauth-rceThird Party Advisory
• https://www.exploit-db.com/exploits/40862/
• https://www.youtube.com/watch?v=aq37lQKa9skExploit

Published

Dec 3, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9790Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9791Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9792Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9793The sock_setsockopt function in net/core/sock.c in the Linux…7.8
• CVE-2016-9794Race condition in the snd_pcm_period_elapsed function in sou…7.8
• CVE-2016-9795The casrvc program in CA Common Services, as used in CA Clie…7.8
• CVE-2016-9797In BlueZ 5.42, a buffer over-read was observed in "l2cap_dum…
• CVE-2016-9798In BlueZ 5.42, a use-after-free was identified in "conf_opt"…
• CVE-2016-9799In BlueZ 5.42, a buffer overflow was observed in "pklg_read_…
• CVE-2016-9800In BlueZ 5.42, a buffer overflow was observed in "pin_code_r…
• CVE-2016-9801In BlueZ 5.42, a buffer overflow was observed in "set_ext_ct…
• CVE-2016-9802In BlueZ 5.42, a buffer over-read was identified in "l2cap_p…