PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6271 Bzrtp Project CVE debrief

CVE-2016-6271 is a high-severity flaw in Bzrtp/libbzrtp 1.0.x before 1.0.4. According to NVD, a missing HVI check during DHPart2 packet reception can allow a man-in-the-middle attacker to carry out spoofing attacks. The vulnerability was published on 2017-01-18 and later modified in the NVD record on 2026-05-13; that later date reflects record maintenance, not a new disclosure date.

Vendor
Bzrtp Project
Product
Bzrtp
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Teams that ship or embed libbzrtp 1.0.0, 1.0.2, or 1.0.3, especially products that rely on Bzrtp for authenticated secure communications. Security, release engineering, and dependency-management teams should prioritize verification and upgrade planning.

Technical summary

NVD describes the issue as a missing HVI check on DHPart2 packet reception in libbzrtp 1.0.x before 1.0.4. The result is a network-reachable integrity problem (CVSS 3.0: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) that can permit spoofing by a man-in-the-middle attacker. NVD maps the weakness to CWE-254 and lists affected CPEs for bzrtp_project:bzrtp versions 1.0.0, 1.0.2, and 1.0.3.

Defensive priority

High. The issue is remotely reachable, requires no privileges or user interaction, and can directly impact communication authenticity/integrity.

Recommended defensive actions

  • Upgrade libbzrtp to 1.0.4 or later, since versions before 1.0.4 are described as vulnerable.
  • Inventory applications and appliances that bundle or statically link libbzrtp, then confirm whether they use affected 1.0.0, 1.0.2, or 1.0.3 builds.
  • Validate vendor advisories or patches for any downstream products that repackaged bzrtp, because dependency versioning may not be obvious from the product UI.
  • If immediate upgrading is not possible, restrict exposure of affected endpoints and monitor for anomalous session setup or authentication failures while remediation is underway.

Evidence notes

This debrief is based on the NVD CVE record, which states the missing HVI check on DHPart2 reception and lists affected bzrtp_project:bzrtp versions. The supplied MITRE/NVD references include a GitHub commit marked as a patch and a SecurityFocus entry for additional record context. No exploit details or unverified claims were used.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6271 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6271

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6271 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6271

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.