CVE-2016-2056
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute...
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
- Record
CVE-2016-2056- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
- Record
CVE-2016-2056- Updated
- 2026-11-02
EUVDEUVD-2016-3161 No score
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
- Record
EUVD-2016-3161- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9xfv-r389-8vvf
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute...
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
- Record
GHSA-9xfv-r389-8vvf- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
- Record
CVE-2016-2056- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-2056
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
- Record
DEBIAN-CVE-2016-2056- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-2056
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
- Record
UBUNTU-CVE-2016-2056- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0177 No score
Updated xymon packages fix security vulnerabilities
Updated xymon packages fix security vulnerabilities:
The incorrect handling of user-supplied input in the "config" command can trigger a stack-based buffer overflow, resulting in denial of service (via application crash) or remote code execution (CVE-2016-2054).
The incorrect handling of user-supplied input in the "config" command can lead to an information leak by serving sensitive configuration files to a remote user (CVE-2016-2055).
The commands handling password management do not properly validate user-supplied input, and are thus vulnerable to shell command injection by a remote user (CVE-2016-2056).
Incorrect permissions on an internal queuing system allow a user with a local account on the xymon master server to bypass all network-based access control lists, and thus inject messages directly into xymon (CVE-2016-2057).
Incorrect escaping of user-supplied input in status webpages can be used to trigger reflected cross-site scripting attacks (CVE-2016-2058).
Note that to effectively fix CVE-2016-2055, the /etc/xymon/xymonpasswd configuration file should be owned by user and group apache with 640 permissions.
- Record
MGASA-2016-0177- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xymonDebian:12 |
before 4.3.25-1 | 4.3.25-1 |
xymonDebian:13 |
before 4.3.25-1 | 4.3.25-1 |
xymonDebian:14 |
before 4.3.25-1 | 4.3.25-1 |
xymonDebian:7 |
before 4.3.0~beta2.dfsg-9.1+deb7u1, plus listed versions 4.3.0~beta2.dfsg-9.1 |
4.3.0~beta2.dfsg-9.1+deb7u1 |
xymonDebian:8 |
before 4.3.17-6+deb8u1, plus listed versions 4.3.17-6 |
4.3.17-6+deb8u1 |
xymonMageia:5 |
before 4.3.17-5.1.mga5 | 4.3.17-5.1.mga5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Xymon 4.3.25 - useradm Command Execution (Metasploit) | 2019-07-12 |
| Metasploit | Xymon useradm Command Execution | 2016-02-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-2056 is a high vulnerability (CVSS 8.8) in Xymon, published February 28, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 54.5%, the 99th percentile. Fixed in xymon 4.3.25-1.
References
securityfocus.com/archive/1/537522/100/0/threaded
sourceforge.net/p/xymon/code/7892
debian.org/security/2016/dsa-3495
packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html
nvd.nist.gov/vuln/detail/CVE-2016-2056