CVE-2016-8358

mediumpriority · track · 34EPSS 0.005 · 43 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.50% (43rd) EPSS

CVSS 6 · medium

Is it mine?

10 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-27

An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. The affected software does not verify the identities at communication endpoints, which may allow a man-in-the-middle attacker to gain access to the communication channel between endpoints.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationCADD-Solis Medication Safety Softwarecisa_csaf_ot
Smiths Medical has released new versions of the CADD-Solis Medication Safety Software, which mitigates the identified vulnerabilities. The new versions of Smiths Medical’s CADD-Solis Medication Safety Software are Version 3.2, which is distributed within the continental US, and Version 4.1, which is released outside the continental US.

cvss

Technical severity, 0–10. One row per scoring source.

8.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6–8.5

v2.06mediumAV:N/AC:M/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 6.8 · impact 6.4

v3.08.5highCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 6

v3.08.5highCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US

v3.07.8highCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-346USprimaryCWE-300US

affected products (10)

Products and version ranges known to be affected.

Smiths Medical CADD-Solis Medication Safety Software: 1.0all versionscisa_csaf_otUS
Smiths Medical CADD-Solis Medication Safety Software: 2.0all versionscisa_csaf_otUS
Smiths Medical CADD-Solis Medication Safety Software: 3.0all versionscisa_csaf_otUS
Smiths Medical CADD-Solis Medication Safety Software: 3.1all versionscisa_csaf_otUS
Smiths Medical CADD-Solis Medication Safety Softwareall versionscisa_csaf_otUS
n/a Smiths-Medical CADD-Solis Medication Safety Software through 3.1≤ Smiths-Medical CADD-Solis Medication Safety Software through 3.1enisa_euvdEU
smiths-medical cadd-solis medication safety software= 1.0nvdUScpe:2.3:a:smiths-medical:cadd-solis_medication_safety_software:*:*:*:*:*:*:*:*
smiths-medical cadd-solis medication safety software= 2.0nvdUScpe:2.3:a:smiths-medical:cadd-solis_medication_safety_software:*:*:*:*:*:*:*:*
smiths-medical cadd-solis medication safety software= 3.0nvdUScpe:2.3:a:smiths-medical:cadd-solis_medication_safety_software:*:*:*:*:*:*:*:*
smiths-medical cadd-solis medication safety software= 3.1nvdUScpe:2.3:a:smiths-medical:cadd-solis_medication_safety_software:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSMA-16-306-01Smiths Medical CADD-Solis Medication Safety Software Vulnerabilities2016-08-05icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

published 2017-02-13modified 2026-06-17

related (925)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-34291US	high8.8OT critical	92.8% (100th)	KEV	2025-12-05
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_…
CVE-2015-4495US	high8.8OT critical	68.6% (99th)	KEV	2015-08-08
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitr…
CVE-2024-23898US	high8.8	67.2% (99th)	Exploit	2024-01-24
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, r…
CVE-2009-1185US	high7.2OT high	80.5% (100th)	Exploit	2009-04-17
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
CVE-2023-29711US	critical9.8	70.3% (99th)	—	2023-06-22
An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.

+920 more

references (7)

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/94630 cnnvd
https://ics-cert.us-cert.gov/advisories/ICSMA-16-306-01 cnnvd
https://www.smiths-medical.com/Patchcnnvd
http://www.securityfocus.com/bid/94630 enisa_euvd
https://ics-cert.us-cert.gov/advisories/ICSMA-16-306-01 enisa_euvd
http://www.securityfocus.com/bid/94630Third Party AdvisoryVDB Entrynvd
https://ics-cert.us-cert.gov/advisories/ICSMA-16-306-01Third Party AdvisoryUS Government Resourcenvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan