CVE-2016-2296

highPriorität · beachten · 70EPSS 0.643 · 99. PerzentilExploit · funktionalEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · funktional

Likely / severe?

64.3% (99th) EPSS

CVSS 7.5 · high

Is it mine?

13 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-27

Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

MitigationWEB'log Basic 100cisa_csaf_ot
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/.
MitigationWEB'log Lightcisa_csaf_ot
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/.
MitigationWEB'log Procisa_csaf_ot
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/.
MitigationWEB'log Pro Unlimitedcisa_csaf_ot
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.4

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.4

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.09.4criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Lprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.5

v3.09.4criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Lsecondary · CISA US

v3.09.4criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:Hsecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-254USprimärCWE-284US

Exploits (2)

Öffentlicher Proof-of-Concept- und Exploit-Code.

auxiliary/scanner/http/meteocontrol_weblog_extractadminMeteocontrol WEBlog Password Extractorfunktional · metasploit
EDB-39822Meteocontrol WEB’log - Admin Password Disclosure (Metasploit)PoC · exploit_db

betroffene Produkte (13)

Betroffene Produkte und Versionsbereiche.

Meteocontrol WEB'log Basic 100: vers:all/*alle Versionencisa_csaf_otUS
Meteocontrol WEB'log Light: vers:all/*alle Versionencisa_csaf_otUS
Meteocontrol WEB'log Pro Unlimited: vers:all/*alle Versionencisa_csaf_otUS
Meteocontrol WEB'log Pro: vers:all/*alle Versionencisa_csaf_otUS
Meteocontrol WEB'log Basic 100≤ vers:all/*cisa_csaf_otUS
Meteocontrol WEB'log Light≤ vers:all/*cisa_csaf_otUS
Meteocontrol WEB'log Pro≤ vers:all/*cisa_csaf_otUS
Meteocontrol WEB'log Pro Unlimited≤ vers:all/*cisa_csaf_otUS
n/a n/a≤ n/aenisa_euvdEU
meteocontrol web'log basic 100alle VersionennvdUScpe:2.3:a:meteocontrol:web\'log_basic_100:*:*:*:*:*:*:*:*
meteocontrol web'log lightalle VersionennvdUScpe:2.3:a:meteocontrol:web\'log_light:*:*:*:*:*:*:*:*
meteocontrol web'log proalle VersionennvdUScpe:2.3:a:meteocontrol:web\'log_pro:*:*:*:*:*:*:*:*
meteocontrol web'log pro unlimitedalle VersionennvdUScpe:2.3:a:meteocontrol:web\'log_pro_unlimited:*:*:*:*:*:*:*:*

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-16-133-01AMeteocontrol WEB'log Vulnerabilities (Update A)2016-02-13icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

veröffentlicht 2016-05-14geändert 2026-06-17

verwandt (800)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2024-21351US	—OT kritisch	27.8% (98th)	KEV	2024-02-13
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2023-36025US	high8.8OT kritisch	88.1% (100th)	KEV	2023-11-14
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2023-36584US	—OT kritisch	3.25% (88th)	KEV	2023-10-10
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2023-32049US	—OT kritisch	4.16% (91st)	KEV	2023-07-11
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2023-24880US	—OT kritisch	78.0% (100th)	KEV	2023-03-14
Windows SmartScreen Security Feature Bypass Vulnerability

+795 weitere

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan