CVE-2016-20096
Linknat VOS3000 and VOS2009 devices, firmware versions 2.1.2.0 and earlier, have an unauthenticated SQL injection in the login endpoint. Attackers can send crafted POST requests to inject SQL, retrieve results, and extract credentials and database data.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Linknat VOS3000 and VOS2009 devices, firmware versions 2.1.2.0 and earlier, used by network administrators and IT staff.
Real-world impact
An attacker can run arbitrary SQL commands, extract plaintext credentials, and read any database content, effectively gaining DBA-level access.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high impact: it is unauthenticated, remote, and allows attackers to execute arbitrary SQL commands, giving them full database control.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources