Read the docs
TI-2016-01887 Aliases CVE-2016-2056GHSA-9xfv-r389-8vvf

xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to…

Priority HIGH 71CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.

Why it matters now

EPSS 0.54507 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:xymon:xymon:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableXymon
cpe:2.3:a:xymon:xymon:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableXymon
cpe:2.3:a:xymon:xymon:4.1.2:p1:*:*:*:*:*:*4.1.2 p1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.1.2:p2:*:*:*:*:*:*4.1.2 p2VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2:alfa:*:*:*:*:*:*4.2 alfaVulnerableXymon
cpe:2.3:a:xymon:xymon:4.2:beta20060605:*:*:*:*:*:*4.2 beta20060605VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2:rc20060712:*:*:*:*:*:*4.2 rc20060712VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2.2:*:*:*:*:*:*:*4.2.2VulnerableXymon
  • cpe:2.3:a:xymon:xymon:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.1.2:p1:*:*:*:*:*:* Versions 4.1.2 p1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.1.2:p2:*:*:*:*:*:* Versions 4.1.2 p2 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2:alfa:*:*:*:*:*:* Versions 4.2 alfa Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2:beta20060605:*:*:*:*:*:* Versions 4.2 beta20060605 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2:rc20060712:*:*:*:*:*:* Versions 4.2 rc20060712 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·Xymon
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:xymon:xymon:4.2.2:rc1:*:*:*:*:*:*4.2.2 rc1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2.3:*:*:*:*:*:*:*4.2.3VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2.3:rc1:*:*:*:*:*:*4.2.3 rc1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:beta1:*:*:*:*:*:*4.3.0 beta1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:beta2:*:*:*:*:*:*4.3.0 beta2VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:beta3:*:*:*:*:*:*4.3.0 beta3VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:rc1:*:*:*:*:*:*4.3.0 rc1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.1:*:*:*:*:*:*:*4.3.1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.2:*:*:*:*:*:*:*4.3.2VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.3:*:*:*:*:*:*:*4.3.3VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.4:*:*:*:*:*:*:*4.3.4VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.5:*:*:*:*:*:*:*4.3.5VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.6:*:*:*:*:*:*:*4.3.6VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.7:*:*:*:*:*:*:*4.3.7VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.8:*:*:*:*:*:*:*4.3.8VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.9:*:*:*:*:*:*:*4.3.9VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.10:*:*:*:*:*:*:*4.3.10VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.11:*:*:*:*:*:*:*4.3.11VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.12:*:*:*:*:*:*:*4.3.12VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.13:*:*:*:*:*:*:*4.3.13VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.14:*:*:*:*:*:*:*4.3.14VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.15:*:*:*:*:*:*:*4.3.15VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.16:*:*:*:*:*:*:*4.3.16VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.17:*:*:*:*:*:*:*4.3.17VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.18:*:*:*:*:*:*:*4.3.18VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.19:*:*:*:*:*:*:*4.3.19VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.19:rc1:*:*:*:*:*:*4.3.19 rc1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.20:*:*:*:*:*:*:*4.3.20VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.21:*:*:*:*:*:*:*4.3.21VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.22:*:*:*:*:*:*:*4.3.22VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.23:*:*:*:*:*:*:*4.3.23VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.24:*:*:*:*:*:*:*4.3.24VulnerableXymon
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
  • cpe:2.3:a:xymon:xymon:4.2.2:rc1:*:*:*:*:*:* Versions 4.2.2 rc1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2.3:rc1:*:*:*:*:*:* Versions 4.2.3 rc1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:beta1:*:*:*:*:*:* Versions 4.3.0 beta1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:beta2:*:*:*:*:*:* Versions 4.3.0 beta2 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:beta3:*:*:*:*:*:* Versions 4.3.0 beta3 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:rc1:*:*:*:*:*:* Versions 4.3.0 rc1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.5:*:*:*:*:*:*:* Versions 4.3.5 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.7:*:*:*:*:*:*:* Versions 4.3.7 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.8:*:*:*:*:*:*:* Versions 4.3.8 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.9:*:*:*:*:*:*:* Versions 4.3.9 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.10:*:*:*:*:*:*:* Versions 4.3.10 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.11:*:*:*:*:*:*:* Versions 4.3.11 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.12:*:*:*:*:*:*:* Versions 4.3.12 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.13:*:*:*:*:*:*:* Versions 4.3.13 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.14:*:*:*:*:*:*:* Versions 4.3.14 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.15:*:*:*:*:*:*:* Versions 4.3.15 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.16:*:*:*:*:*:*:* Versions 4.3.16 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.17:*:*:*:*:*:*:* Versions 4.3.17 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.18:*:*:*:*:*:*:* Versions 4.3.18 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.19:*:*:*:*:*:*:* Versions 4.3.19 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.19:rc1:*:*:*:*:*:* Versions 4.3.19 rc1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.20:*:*:*:*:*:*:* Versions 4.3.20 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.21:*:*:*:*:*:*:* Versions 4.3.21 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.22:*:*:*:*:*:*:* Versions 4.3.22 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.23:*:*:*:*:*:*:* Versions 4.3.23 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.24:*:*:*:*:*:*:* Versions 4.3.24 Vulnerable ·Xymon
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-2056
  2. 2026-10-03 Alias added: GHSA-9xfv-r389-8vvf
  3. 2026-10-14 EPSS moved to the 99th percentile and above

References

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences