Arbitrary code execution in Solutions Enabler Virtual Appliance and VMAX Virtual Appliance Manager - CVE-2016-6646
Published: October 4, 2016 / Updated: October 5, 2016
Vulnerability identifier: #VU758
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-6646
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause arbitrary code execution on the target system.
The weakness is caused by insufficient input validation. By uploading specially crafted data to the GetSymmCmdRequest or RemoteServiceHandler class atackers can execute arbitary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
The weakness is caused by insufficient input validation. By uploading specially crafted data to the GetSymmCmdRequest or RemoteServiceHandler class atackers can execute arbitary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Affected software
Solutions Enabler Virtual Appliance
VMAX Virtual Appliance Manager
VMAX Virtual Appliance Manager
How to mitigate CVE-2016-6646
Update to version 8.3.0.