CVE-2016-2310
Estado: ModificadaCrítica (9.8)—
Gravedad9.8Crítica · CVSS 3.1
Probabilidad de explotación3.22 %mayor que el 88 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
Switches General Electric (GE) Multilink ML800, ML1200, ML1600 y ML2400 con firmware en versiones anteriores a 5.5.0 y switches ML810, ML3000 y ML3100 con firmware en versiones anteriores a 5.5.0k tienen credenciales embebidas, lo que permite a atacantes remotos modificar ajustes de configuración a través de la interfaz web.
CVSS
- Puntuación base
- 9.8
- Versión
- 3.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 3.22 %
- Percentil entre todas las CVEs puntuadas
- 88
- Fecha de la puntuación
- 21/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-798
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-2310",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "ics-cert@hq.dhs.gov",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-06-09T10:59:00.290",
"references": [
{
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-154-01",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-154-01",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-798"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface."
},
{
"lang": "es",
"value": "Switches General Electric (GE) Multilink ML800, ML1200, ML1600 y ML2400 con firmware en versiones anteriores a 5.5.0 y switches ML810, ML3000 y ML3100 con firmware en versiones anteriores a 5.5.0k tienen credenciales embebidas, lo que permite a atacantes remotos modificar ajustes de configuración a través de la interfaz web."
}
],
"lastModified": "2026-06-17T00:43:47.990",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "57707326-C7A4-412B-BF90-98E12CF97312",
"versionEndIncluding": "5.5.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml1200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1179F179-510A-4A97-8365-B81C0E0FC605"
},
{
"criteria": "cpe:2.3:h:ge:multilink_ml1600:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "620703E4-1D78-44CB-B353-517A8AB2A815"
},
{
"criteria": "cpe:2.3:h:ge:multilink_ml2400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "426A283A-540C-43F2-8397-52668BADDEB8"
},
{
"criteria": "cpe:2.3:h:ge:multilink_ml800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9A00E85C-1B21-43F7-8323-F759216BFB90"
},
{
"criteria": "cpe:2.3:h:ge:multilink_ml810:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "81DC26E5-D3D7-41C6-B654-B06FA0461451"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml3000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7EE40202-1D8F-406E-8281-B67DCF5E8501"
},
{
"criteria": "cpe:2.3:h:ge:multilink_ml3100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D72F9922-A473-4076-91E3-CF3899C179D7"
},
{
"criteria": "cpe:2.3:h:ge:multilink_ml810:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "81DC26E5-D3D7-41C6-B654-B06FA0461451"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF7A9653-BF61-4480-B349-577C6155B991",
"versionEndIncluding": "5.5.0k"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"evaluatorComment": "CWE-798: Use of Hard-coded Credentials",
"sourceIdentifier": "ics-cert@hq.dhs.gov"
}