Vulnerability Details : CVE-2016-7456

Public exploit exists!
VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session.
Published 2016-12-29 09:59:01
Updated 2017-01-03 18:43:17
Source VMware
View at NVD,   CVE.org

Products affected by CVE-2016-7456

Exploit prediction scoring system (EPSS) score for CVE-2016-7456

EPSS FAQ
8.34%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2016-7456

  • VMware VDP Known SSH Key
    Disclosure Date: 2016-12-20
    First seen: 2020-04-26
    exploit/linux/ssh/vmware_vdp_known_privkey
    VMware vSphere Data Protection appliances 5.5.x through 6.1.x contain a known ssh private key for the local user admin who is a sudoer without password. Authors: - phroxvs

CVSS scores for CVE-2016-7456

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
10.0
 HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
 NIST
9.8
 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

CWE ids for CVE-2016-7456

  • Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-7456

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close