Read the docs
TI-2016-00826 Aliases CVE-2016-0917GHSA-8g56-72qr-4pmv

The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and…

Priority MEDIUM 49CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638), VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra (all supported versions) does not prevent duplicate NTLM challenge-response nonces, which makes it easier for remote attackers to execute arbitrary code, or read or write to files, via a series of authentication requests, a related issue to CVE-2010-0231.

Why it matters now

EPSS 0.04181 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:emc:vnx1_oe_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableEMC
cpe:2.3:a:emc:vnx2_oe_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableEMC
cpe:2.3:a:emc:vnxe_oe_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableEMC
cpe:2.3:h:emc:vnx5200:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
cpe:2.3:h:emc:vnx5400:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
cpe:2.3:h:emc:vnx5600:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
cpe:2.3:h:emc:vnx5800:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
cpe:2.3:h:emc:vnxe1600:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
cpe:2.3:h:emc:vnxe3100:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
cpe:2.3:h:emc:vnxe3150:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
  • cpe:2.3:a:emc:vnx1_oe_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·EMC
  • cpe:2.3:a:emc:vnx2_oe_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·EMC
  • cpe:2.3:a:emc:vnxe_oe_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·EMC
  • cpe:2.3:h:emc:vnx5200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
  • cpe:2.3:h:emc:vnx5400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
  • cpe:2.3:h:emc:vnx5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
  • cpe:2.3:h:emc:vnx5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
  • cpe:2.3:h:emc:vnxe1600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
  • cpe:2.3:h:emc:vnxe3100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
  • cpe:2.3:h:emc:vnxe3150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:emc:vnxe3200:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
cpe:2.3:h:emc:vnxe3200_hybrid:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
cpe:2.3:h:emc:vnxe3300:-:*:*:*:*:*:*:*not specified by NVDRunning onEMC
  • cpe:2.3:h:emc:vnxe3200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
  • cpe:2.3:h:emc:vnxe3200_hybrid:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC
  • cpe:2.3:h:emc:vnxe3300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·EMC

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-0917
  2. 2026-10-03 Alias added: GHSA-8g56-72qr-4pmv

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences