CVE-2016-2203

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-04-22 · updated 2026-06-17
Weakness: CWE-255

Description

The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveraging certain read privileges.

Affected products

Symantec Messaging Gateway: 10.6.0-patch3, 10.6.0-patch5, 10.6.0-patch7

References

http://packetstormsecurity.com/files/136758/Symantec-Brightmail-10.6.0-7-LDAP-Credential-Grabber.html
http://www.securityfocus.com/bid/86137
http://www.securitytracker.com/id/1035609
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160418_00
https://www.exploit-db.com/exploits/39715/
http://packetstormsecurity.com/files/136758/Symantec-Brightmail-10.6.0-7-LDAP-Credential-Grabber.html
http://www.securityfocus.com/bid/86137
http://www.securitytracker.com/id/1035609
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160418_00
https://www.exploit-db.com/exploits/39715/

Get alerted when CVE-2016-2203 or the next vulnerability affects your stack