CVE-2016-1542

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x,...

7.5 HighPublic exploit

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

74.6%Up 39.9 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2016-1542
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-1542
Updated: 2026-11-02

EUVDEUVD-2016-2637 No score

Record: EUVD-2016-2637
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2592-27f9-rh84 7.5

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x,...

Record: GHSA-2592-27f9-rh84
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-20
Updated: 2026-11-02

Affected products

bmc bladelogic server automation console

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	BMC BladeLogic 8.3.00.64 - Remote Command Execution	2018-01-26
Exploit-DB	BMC Server Automation RSCD Agent - NSH Remote Command Execution (Metasploit)	2018-02-01
Metasploit	BMC Server Automation RSCD Agent NSH Remote Command Execution	2016-03-16
PoC in GitHub	bao7uo/bmc_bladelogic	2018-01-24
PoC in GitHub	patriknordlen/bladelogic_bmc-cve-2016-1542	2017-04-27

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-1542 is a high vulnerability (CVSS 7.5) in Bmc Bladelogic Server Automation Console, published June 13, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.6%, the 99th percentile. No source names a fixed version.