CVE-2016-0861

Published: Feb 5, 2016Modified: May 6, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors.

Affected (1)

Products: Ge: Ups Snmp Web Adapter Firmware

1 product

Ups Snmp Web Adapter Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ge Ups Snmp Web Adapter Firmware	Up to 4.7

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (10)

http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf

Source: ics-cert@hq.dhs.gov

Vendor Advisory

http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html

Source: ics-cert@hq.dhs.gov

http://seclists.org/fulldisclosure/2016/Feb/21

Source: ics-cert@hq.dhs.gov

https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.exploit-db.com/exploits/39408/

Source: ics-cert@hq.dhs.gov

http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf