Read the docs
TI-2016-01888 Aliases CVE-2016-2057GHSA-529x-f9rr-pg3j

lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions…

Priority LOW 16CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue.

Why it matters now

EPSS 0.00469 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:xymon:xymon:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableXymon
cpe:2.3:a:xymon:xymon:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableXymon
cpe:2.3:a:xymon:xymon:4.1.2:p1:*:*:*:*:*:*4.1.2 p1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.1.2:p2:*:*:*:*:*:*4.1.2 p2VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2:alfa:*:*:*:*:*:*4.2 alfaVulnerableXymon
cpe:2.3:a:xymon:xymon:4.2:beta20060605:*:*:*:*:*:*4.2 beta20060605VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2:rc20060712:*:*:*:*:*:*4.2 rc20060712VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2.2:*:*:*:*:*:*:*4.2.2VulnerableXymon
  • cpe:2.3:a:xymon:xymon:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.1.2:p1:*:*:*:*:*:* Versions 4.1.2 p1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.1.2:p2:*:*:*:*:*:* Versions 4.1.2 p2 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2:alfa:*:*:*:*:*:* Versions 4.2 alfa Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2:beta20060605:*:*:*:*:*:* Versions 4.2 beta20060605 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2:rc20060712:*:*:*:*:*:* Versions 4.2 rc20060712 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·Xymon
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:xymon:xymon:4.2.2:rc1:*:*:*:*:*:*4.2.2 rc1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2.3:*:*:*:*:*:*:*4.2.3VulnerableXymon
cpe:2.3:a:xymon:xymon:4.2.3:rc1:*:*:*:*:*:*4.2.3 rc1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:beta1:*:*:*:*:*:*4.3.0 beta1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:beta2:*:*:*:*:*:*4.3.0 beta2VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:beta3:*:*:*:*:*:*4.3.0 beta3VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.0:rc1:*:*:*:*:*:*4.3.0 rc1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.1:*:*:*:*:*:*:*4.3.1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.2:*:*:*:*:*:*:*4.3.2VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.3:*:*:*:*:*:*:*4.3.3VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.4:*:*:*:*:*:*:*4.3.4VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.5:*:*:*:*:*:*:*4.3.5VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.6:*:*:*:*:*:*:*4.3.6VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.7:*:*:*:*:*:*:*4.3.7VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.8:*:*:*:*:*:*:*4.3.8VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.9:*:*:*:*:*:*:*4.3.9VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.10:*:*:*:*:*:*:*4.3.10VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.11:*:*:*:*:*:*:*4.3.11VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.12:*:*:*:*:*:*:*4.3.12VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.13:*:*:*:*:*:*:*4.3.13VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.14:*:*:*:*:*:*:*4.3.14VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.15:*:*:*:*:*:*:*4.3.15VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.16:*:*:*:*:*:*:*4.3.16VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.17:*:*:*:*:*:*:*4.3.17VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.18:*:*:*:*:*:*:*4.3.18VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.19:*:*:*:*:*:*:*4.3.19VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.19:rc1:*:*:*:*:*:*4.3.19 rc1VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.20:*:*:*:*:*:*:*4.3.20VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.21:*:*:*:*:*:*:*4.3.21VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.22:*:*:*:*:*:*:*4.3.22VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.23:*:*:*:*:*:*:*4.3.23VulnerableXymon
cpe:2.3:a:xymon:xymon:4.3.24:*:*:*:*:*:*:*4.3.24VulnerableXymon
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
  • cpe:2.3:a:xymon:xymon:4.2.2:rc1:*:*:*:*:*:* Versions 4.2.2 rc1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.2.3:rc1:*:*:*:*:*:* Versions 4.2.3 rc1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:beta1:*:*:*:*:*:* Versions 4.3.0 beta1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:beta2:*:*:*:*:*:* Versions 4.3.0 beta2 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:beta3:*:*:*:*:*:* Versions 4.3.0 beta3 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.0:rc1:*:*:*:*:*:* Versions 4.3.0 rc1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.5:*:*:*:*:*:*:* Versions 4.3.5 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.7:*:*:*:*:*:*:* Versions 4.3.7 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.8:*:*:*:*:*:*:* Versions 4.3.8 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.9:*:*:*:*:*:*:* Versions 4.3.9 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.10:*:*:*:*:*:*:* Versions 4.3.10 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.11:*:*:*:*:*:*:* Versions 4.3.11 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.12:*:*:*:*:*:*:* Versions 4.3.12 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.13:*:*:*:*:*:*:* Versions 4.3.13 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.14:*:*:*:*:*:*:* Versions 4.3.14 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.15:*:*:*:*:*:*:* Versions 4.3.15 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.16:*:*:*:*:*:*:* Versions 4.3.16 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.17:*:*:*:*:*:*:* Versions 4.3.17 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.18:*:*:*:*:*:*:* Versions 4.3.18 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.19:*:*:*:*:*:*:* Versions 4.3.19 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.19:rc1:*:*:*:*:*:* Versions 4.3.19 rc1 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.20:*:*:*:*:*:*:* Versions 4.3.20 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.21:*:*:*:*:*:*:* Versions 4.3.21 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.22:*:*:*:*:*:*:* Versions 4.3.22 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.23:*:*:*:*:*:*:* Versions 4.3.23 Vulnerable ·Xymon
  • cpe:2.3:a:xymon:xymon:4.3.24:*:*:*:*:*:*:* Versions 4.3.24 Vulnerable ·Xymon
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-2057
  2. 2026-10-03 Alias added: GHSA-529x-f9rr-pg3j

References

Patch 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences