The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD p…

published 2016-04-22 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-3287

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.1%; EPSS 7.1% chance of exploitation in 30 days, percentile 94%
public exploits: 2; Metasploit, Exploit-DB

The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveraging certain read privileges.

Timeline

2015-12-17 First public exploit (Metasploit auxiliary/scanner/http/symantec_brightmail_ldapcreds)
2016-04-22 Published

Exploit prediction

7.06% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit auxiliary/scanner/http/symantec_brightmail_ldapcreds Symantec Messaging Gateway 10 Exposure of Stored AD Password Vulnerability metasploit auxiliary, normal rank, 2015-12-17
EDB-39715 Symantec Brightmail 10.6.0-7 - LDAP Credentials Disclosure (Metasploit) webapps, 2016-04-21
packetstormsecurity.com http://packetstormsecurity.com/files/136758/Symantec-Brightmail-10.6.0-7-LDAP-Credential-Grabber.html referenced PoC, tagged "exploit" by a source, unverified
securityfocus.com http://www.securityfocus.com/bid/86137 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-255 Credentials Management Errors

References

exploit-db.com /exploits/39715/
exploit, third-party-advisory, vdb-entry
packetstormsecurity.com /files/136758/Symantec-Brightmail-10.6.0-7-LDAP-Credential-Grabber.html
exploit, third-party-advisory, vdb-entry
securityfocus.com /bid/86137
vdb-entry, exploit, third-party-advisory
symantec.com /security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160418
vendor-advisory
securitytracker.com /id/1035609
vdb-entry, third-party-advisory

Sources

CVE List CVE-2016-2203
NVD CVE-2016-2203

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary