CVE-2016-0904

8.6 highEPSS 1.4%

Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by leveraging knowledge of this key from another installation.

Severity

CVSS 3.0

8.6 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-310
Published: 2016-09-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

emc:avamar_server

References

http://seclists.org/bugtraq/2016/Sep/31
http://www.securityfocus.com/bid/93026
http://www.securitytracker.com/id/1036844
http://seclists.org/bugtraq/2016/Sep/31
http://www.securityfocus.com/bid/93026

Check your stack JSON