CVE-2016-6602 Zohocorp CVE debrief

Who should care

Administrators and security teams responsible for ZOHO WebNMS Framework 5.2 or 5.2 SP1, especially anyone managing server file permissions, stored credentials, and exposed WebNMS deployments.

Technical summary

NVD describes a weak obfuscation algorithm used to store passwords in WebNMS Framework 5.2 and 5.2 SP1. If an attacker can access WEB-INF/conf/securitydbData.xml, stored passwords may be recovered in cleartext. The official record lists CWE-327 and a CVSS v3.0 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD also states this issue may be combined with CVE-2016-6601 for a remote exploit path.

Defensive priority

Critical. Credential exposure can lead to immediate account compromise and lateral movement, and NVD indicates the issue may be chained with another flaw for remote exploitation.

Recommended defensive actions

• Restrict access to WEB-INF/conf/securitydbData.xml and the broader WEB-INF/conf directory at the filesystem and application layers.
• Review all WebNMS Framework deployments and confirm whether any instance is running version 5.2 or 5.2 SP1.
• Rotate any credentials that may have been stored in or exposed by affected installations.
• Follow vendor guidance referenced by the WebNMS forum notice and monitor official advisories for remediation instructions.
• Check logs and access controls for unauthorized reads of configuration files or abnormal use of recovered credentials.
• If CVE-2016-6601 is present in the same environment, remediate it as well because NVD notes the two issues can be combined.

Evidence notes

The NVD description states that WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords and that access to WEB-INF/conf/securitydbData.xml can expose cleartext passwords. The official NVD record lists the affected CPEs for WebNMS Framework 5.2 and 5.2 SP1, classifies the weakness as CWE-327, and assigns a critical CVSS v3.0 vector. The NVD reference list includes a vendor forum notice plus third-party technical references; this debrief relies on the official description and metadata, not on exploit material.

Official resources