Vulnerability Report

CVE-2016-5795

Title: Carrier Automatedlogic Webctrl RCE

XXE

Proof Of Concept

No public PoC currently indexed for CVE-2016-5795.

CWE Category CWE-611

Published Date Aug 31, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 7.3 CVSS v3.0

Exploit Probability (EPSS)

2.24%

Vulnerability Summary

CVE-2016-5795: An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.

Impacted Vendors

carrier 1

automatedlogic 2

Reference Links

http://www.securityfocus.com/bid/100558 https://ics-cert.us-cert.gov/advisories/ICSA-17-150-01 http://www.securityfocus.com/bid/100558 https://ics-cert.us-cert.gov/advisories/ICSA-17-150-01

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns