TI-2016-05644 Aliases CVE-2016-6593 GHSA-7g77-97mx-6jpp

Untrusted search path in Symantec VIP Access Desktop

LOW 36CWE-426Published 2020-01-08 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

A code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP Access Desktop before 2.2.2, which could let local malicious users execute arbitrary code.

Why it matters now

EPSS 0.00807 57th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed VIP Access Desktop (Symantec): 2.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Symantec	VIP Access Desktop	before 2.2.2	2.2.2	Patch available	CNA

VIP Access Desktop VendorSymantec Affected before 2.2.2 Fixed in 2.2.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:symantec:vip_access_desktop::::::::	before 2.2.2	Vulnerable	Symantec

cpe:2.3:a:symantec:vip_access_desktop:*:*:*:*:*:*:*:* Versions before 2.2.2 Vulnerable ·Symantec

Remediation

Fix · CNA VIP Access Desktop (Symantec) Fixed in 2.2.2

Timeline

2026-10-02 Threatist record created from CVE-2016-6593
2026-10-03 Alias added: GHSA-7g77-97mx-6jpp

References

Exploit 1

http://packetstormsecurity.com/files/140098/Symantec-VIP-Access-Arbitrary-DLL-Execution.html

Advisory 1

https://support.symantec.com/us/en/article.symsa1388.html

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences