CVE-2016-3128: High severity BlackBerry Enterprise Service vulnerability

Published Jan 13, 2017

Updated

A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitimate device to the BES, gain access to device parameters for the BES, or send false information to the BES by gaining access to specific information about a device that was legitimately enrolled on the BES.

Affected Software

12 affected components

BlackBerry Enterprise Service=12.0.0

BlackBerry Enterprise Service=12.0.1

BlackBerry Enterprise Service=12.1.0

BlackBerry Enterprise Service=12.2.0

BlackBerry Enterprise Service=12.2.1

BlackBerry Enterprise Service=12.3.0

BlackBerry Enterprise Service=12.3.1

BlackBerry Enterprise Service=12.4.0

BlackBerry Enterprise Service=12.4.1

BlackBerry Enterprise Service=12.5.0a

BlackBerry Enterprise Service=12.5.1

BlackBerry Enterprise Service=12.5.2

Event History

Jan 13, 2017

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-3128?

CVE-2016-3128 is classified as a medium severity vulnerability due to its potential for spoofing and unauthorized access.

How do I fix CVE-2016-3128?

To mitigate CVE-2016-3128, it is recommended to upgrade the BlackBerry Enterprise Server to version 12.5.2 or later.

What software versions are affected by CVE-2016-3128?

CVE-2016-3128 affects BlackBerry Enterprise Server versions 12.0.0 through 12.5.2.

Can CVE-2016-3128 allow unauthorized device enrollment?

Yes, CVE-2016-3128 allows remote attackers to enroll unauthorized devices to the BlackBerry Enterprise Server.

What type of attack does CVE-2016-3128 enable?

CVE-2016-3128 enables spoofing attacks that can lead to unauthorized access and misinformation sent to the BlackBerry Enterprise Server.