CVE-2016-9111
First published: Mon Nov 07 2016(Updated: )
Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical access to a VDI for temporary disconnection of a LAN cable. NOTE: as of 20161208, the vendor could not reproduce the issue, stating "the researcher was unable to provide us with information that would allow us to confirm the behaviour and, despite extensive investigation on test deployments of supported products, we were unable to reproduce the behaviour as he described. The researcher has also, despite additional requests for information, ceased to respond to us."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Citrix Receiver | =4.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-9111?
CVE-2016-9111 has a moderate severity rating due to the potential for unauthorized access through an authentication bypass.
How do I fix CVE-2016-9111?
To fix CVE-2016-9111, users are advised to update to the latest version of Citrix Receiver Desktop that addresses this vulnerability.
What causes CVE-2016-9111?
CVE-2016-9111 is caused by incorrect access control mechanisms that allow physical access exploitation.
Who is affected by CVE-2016-9111?
CVE-2016-9111 specifically affects users of Citrix Receiver Desktop Lock version 4.5.
Can CVE-2016-9111 be exploited remotely?
CVE-2016-9111 requires physical access to the device, making it not exploitable remotely.
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/citrix
- canonical/citrix receiver
- version/citrix receiver/4.5