CVE-2016-15058
Raw vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2016-15058 is a high-severity Storing Passwords in a Recoverable Format (CWE-257) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2016-15058 is a credential exposure vulnerability (CWE-257) affecting Hirschmann HiLCOS Classic Platform switches, including Classic L2E, L2P, L3E, and L3P versions prior to 09.0.06, as well as Classic L2B prior to 05.3.07. The flaw occurs when the password synchronization feature with SNMPv1/v2 community strings is enabled, causing user passwords to be transmitted in plaintext.
Attackers with adjacent network access can exploit this vulnerability without authentication or user interaction, requiring low attack complexity. By sniffing SNMP traffic or extracting configuration data, they can recover plaintext credentials, achieving high confidentiality and integrity impacts (no availability impact) for unauthorized administrative access to the switches, as reflected in its CVSS v3.1 base score of 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vendor and advisory sources, including the Belden security bulletin (https://assets.belden.com/m/1d8273c6205dc400/original/Security-Bulletin-Password-Sync-SNMP-v1-v2-BSECV-2016-12.pdf), CERT KB entry (https://www.kb.cert.org/vuls/id/507216), and Vulncheck advisory (https://www.vulncheck.com/advisories/hirschmann-hilcos-classic-platform-password-exposure-via-snmp), indicate mitigation through upgrading to Hirschmann HiLCOS Classic Platform versions 09.0.06 or later for L2E, L2P, L3E, and L3P models, and 05.3.07 or later for L2B, along with disabling the SNMPv1/v2 password sync feature where possible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2016-10854
Vulnerability Data
Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the…
more
feature is enabled. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access to the switches.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct plaintext credential transmission over SNMP enables network sniffing (T1040) to capture unsecured credentials (T1552) for subsequent account access.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring timely remediation of the password synchronization flaw through vendor firmware upgrades to fixed versions.
Prevents attackers from sniffing plaintext credentials in SNMPv1/v2 traffic by enforcing cryptographic protection for transmission confidentiality and integrity.
Mitigates credential exposure by prohibiting transmission of authenticators like synchronized passwords in plaintext without cryptographic protection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication information, preventing storage in recoverable formats.
Mandates secure authentication mechanisms that preclude recoverable password storage.
Requires proper use of cryptography, which can mitigate recoverable storage if applied correctly to passwords.
Secure SDLC includes requirements that reduce the likelihood of introducing recoverable password storage.
Secure coding practices can prevent developers from implementing recoverable password storage.