CVE-2016-2509: Infoleak
The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E, L2P, L3E, and L3P before 09.0.06 sets an SNMP community to the same string as the administrator password, which allows remote attackers to obtain sensitive information by sniffing the network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2509?
CVE-2016-2509 is rated as a high severity vulnerability due to the risk of sensitive information disclosure.
How do I fix CVE-2016-2509?
To mitigate CVE-2016-2509, update the firmware of the affected Belden Hirschmann switches to a version that is not vulnerable.
Which devices are affected by CVE-2016-2509?
Devices running Belden Hirschmann Classic Platform switches L2B before version 05.3.07 and L2E, L2P, L3E, and L3P before version 09.0.06 are affected by CVE-2016-2509.
What kind of attack can occur due to CVE-2016-2509?
CVE-2016-2509 allows remote attackers to obtain sensitive information by sniffing the network traffic.
What does CVE-2016-2509 exploit in the Belden Hirschmann devices?
CVE-2016-2509 exploits the password-sync feature that sets an SNMP community string to the same value as the administrator password.