CVE-2015-8800

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-08 · updated 2026-06-17
Weakness: CWE-74

Description

Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allow remote authenticated users to conduct argument-injection attacks by leveraging certain named-pipe access.

Affected products

Symantec Critical System Protection (CSP): 5.2.9
Symantec Data Loss Prevention: 6.5.0, 6.6.0
Broadcom Symantec Data Center Security Server And Agents: 6.6.0
Broadcom Symantec Embedded Security Critical System Protection: 1.0
Broadcom Symantec Embedded Security Critical System Protection For Controllers And Devices: 6.5.0

References

http://www.securityfocus.com/bid/90886
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160607_00
http://www.securityfocus.com/bid/90886
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160607_00

Get alerted when CVE-2015-8800 or the next vulnerability affects your stack